Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
28-04-2021 21:20
Static task
static1
Behavioral task
behavioral1
Sample
DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe
Resource
win7v20210410
General
-
Target
DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe
-
Size
1003KB
-
MD5
73fe7532d75c146f45f2d09ad844d573
-
SHA1
b982e7b808b140625cc1af5b5d093f03b0b44ce3
-
SHA256
08f234ec292a6a493c9c3e21cf1a08a91899bc929de74ed1a833a42da0891bb9
-
SHA512
b930b35292abba797900234f4e5a0a9b1f340e072a9af646fc2dce876fd5757b2bba6fca218e2fe5c7487757880ccfe71a1d624067903ebe833334811cb0dd34
Malware Config
Extracted
remcos
yuyitosjs.duckdns.org:1717
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exedescription pid process target process PID 1888 set thread context of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exepid process 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 1872 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exedescription pid process Token: SeDebugPrivilege 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1872 RegSvcs.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exedescription pid process target process PID 1888 wrote to memory of 360 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe schtasks.exe PID 1888 wrote to memory of 360 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe schtasks.exe PID 1888 wrote to memory of 360 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe schtasks.exe PID 1888 wrote to memory of 360 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe schtasks.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe PID 1888 wrote to memory of 1872 1888 DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe"C:\Users\Admin\AppData\Local\Temp\DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fDecVP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA11F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA11F.tmpMD5
3e60964bfa68fed3f557336a3285b08b
SHA162da84e6dd81a857820adcd5be6e9a5eafb234ec
SHA256711a5eeaa6355b6bdf5cf43e6ff59b865e63351b4ad79ae0a64445729fec60a0
SHA51271b113470b78229d22987d58f2ffabe74d00a4b513ec0b2cb0077ce3d24ff466e4cd7ae06a4e51736fe092db0636d09d461455f993dedb6764f4c946abf31a12
-
memory/360-65-0x0000000000000000-mapping.dmp
-
memory/1872-67-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1872-68-0x0000000000413E54-mapping.dmp
-
memory/1872-69-0x0000000075161000-0x0000000075163000-memory.dmpFilesize
8KB
-
memory/1872-70-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1888-59-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/1888-61-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/1888-62-0x0000000000270000-0x000000000027E000-memory.dmpFilesize
56KB
-
memory/1888-63-0x0000000007FB0000-0x000000000807A000-memory.dmpFilesize
808KB
-
memory/1888-64-0x00000000050F0000-0x0000000005172000-memory.dmpFilesize
520KB