Analysis
-
max time kernel
151s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 00:50
Static task
static1
Behavioral task
behavioral1
Sample
1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe
Resource
win10v20210408
General
-
Target
1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe
-
Size
1.9MB
-
MD5
c4b75a6eaf5fcfc659e9694424d33c3f
-
SHA1
65cd90201c00e8142757ae8227ecf8f76ac79e72
-
SHA256
1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b
-
SHA512
49a0d58d0dfe519fa54fd55ac11a90435a1579542479e81287390e5aa26c19e621f502bfa50bc1d2024fffcb815f468a5908de057efac52d4b0ef97d5934ea17
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
test.exetest.exetest.exepid process 972 test.exe 1004 test.exe 1496 test.exe -
Processes:
resource yara_rule behavioral1/memory/1172-70-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1172-80-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1496-107-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1496-114-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exepid process 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\test\\test.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exetest.exedescription pid process target process PID 368 set thread context of 1172 368 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe PID 972 set thread context of 1004 972 test.exe test.exe PID 972 set thread context of 1496 972 test.exe test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
test.exetest.exedescription pid process Token: SeIncreaseQuotaPrivilege 1496 test.exe Token: SeSecurityPrivilege 1496 test.exe Token: SeTakeOwnershipPrivilege 1496 test.exe Token: SeLoadDriverPrivilege 1496 test.exe Token: SeSystemProfilePrivilege 1496 test.exe Token: SeSystemtimePrivilege 1496 test.exe Token: SeProfSingleProcessPrivilege 1496 test.exe Token: SeIncBasePriorityPrivilege 1496 test.exe Token: SeCreatePagefilePrivilege 1496 test.exe Token: SeBackupPrivilege 1496 test.exe Token: SeRestorePrivilege 1496 test.exe Token: SeShutdownPrivilege 1496 test.exe Token: SeDebugPrivilege 1496 test.exe Token: SeSystemEnvironmentPrivilege 1496 test.exe Token: SeChangeNotifyPrivilege 1496 test.exe Token: SeRemoteShutdownPrivilege 1496 test.exe Token: SeUndockPrivilege 1496 test.exe Token: SeManageVolumePrivilege 1496 test.exe Token: SeImpersonatePrivilege 1496 test.exe Token: SeCreateGlobalPrivilege 1496 test.exe Token: 33 1496 test.exe Token: 34 1496 test.exe Token: 35 1496 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe Token: SeDebugPrivilege 1004 test.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exetest.exetest.exepid process 368 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 972 test.exe 1004 test.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.execmd.exetest.exedescription pid process target process PID 368 wrote to memory of 1172 368 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe PID 368 wrote to memory of 1172 368 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe PID 368 wrote to memory of 1172 368 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe PID 368 wrote to memory of 1172 368 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe PID 368 wrote to memory of 1172 368 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe PID 368 wrote to memory of 1172 368 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe PID 368 wrote to memory of 1172 368 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe PID 368 wrote to memory of 1172 368 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe PID 1172 wrote to memory of 1772 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe cmd.exe PID 1172 wrote to memory of 1772 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe cmd.exe PID 1172 wrote to memory of 1772 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe cmd.exe PID 1172 wrote to memory of 1772 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe cmd.exe PID 1772 wrote to memory of 268 1772 cmd.exe reg.exe PID 1772 wrote to memory of 268 1772 cmd.exe reg.exe PID 1772 wrote to memory of 268 1772 cmd.exe reg.exe PID 1772 wrote to memory of 268 1772 cmd.exe reg.exe PID 1172 wrote to memory of 972 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe test.exe PID 1172 wrote to memory of 972 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe test.exe PID 1172 wrote to memory of 972 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe test.exe PID 1172 wrote to memory of 972 1172 1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe test.exe PID 972 wrote to memory of 1004 972 test.exe test.exe PID 972 wrote to memory of 1004 972 test.exe test.exe PID 972 wrote to memory of 1004 972 test.exe test.exe PID 972 wrote to memory of 1004 972 test.exe test.exe PID 972 wrote to memory of 1004 972 test.exe test.exe PID 972 wrote to memory of 1004 972 test.exe test.exe PID 972 wrote to memory of 1004 972 test.exe test.exe PID 972 wrote to memory of 1004 972 test.exe test.exe PID 972 wrote to memory of 1496 972 test.exe test.exe PID 972 wrote to memory of 1496 972 test.exe test.exe PID 972 wrote to memory of 1496 972 test.exe test.exe PID 972 wrote to memory of 1496 972 test.exe test.exe PID 972 wrote to memory of 1496 972 test.exe test.exe PID 972 wrote to memory of 1496 972 test.exe test.exe PID 972 wrote to memory of 1496 972 test.exe test.exe PID 972 wrote to memory of 1496 972 test.exe test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe"C:\Users\Admin\AppData\Local\Temp\1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe"C:\Users\Admin\AppData\Local\Temp\1d93d97d1d22415d1e1d72244a3e15236c72ca12d34f38c5d3000fac49608a7b.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\DGRTO.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DGRTO.batMD5
527683c48cc4c7190219814c77b72fe0
SHA1d995878a8f4b9824a0508039eeada5376be9a52d
SHA256bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b
SHA512408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
13b3e15ef77a6b9e26c6d0dc9c15fcdf
SHA1e7eeb20d3dbdc5e355c2c5e4a21bdc63fe2384e4
SHA25601d3e85a879cc4f286840acb55fd32e251ca518438e2c342cd6e3cf8433363b0
SHA512bf9a3b647f4b8d26378ca0696f50e9c877ba43cca9936a36eefae0d5b886589230a3b311676a26b5d59e9d1661ef9ed19c6fa5d96d2c7d1850f4e324e0da2819
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
13b3e15ef77a6b9e26c6d0dc9c15fcdf
SHA1e7eeb20d3dbdc5e355c2c5e4a21bdc63fe2384e4
SHA25601d3e85a879cc4f286840acb55fd32e251ca518438e2c342cd6e3cf8433363b0
SHA512bf9a3b647f4b8d26378ca0696f50e9c877ba43cca9936a36eefae0d5b886589230a3b311676a26b5d59e9d1661ef9ed19c6fa5d96d2c7d1850f4e324e0da2819
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
13b3e15ef77a6b9e26c6d0dc9c15fcdf
SHA1e7eeb20d3dbdc5e355c2c5e4a21bdc63fe2384e4
SHA25601d3e85a879cc4f286840acb55fd32e251ca518438e2c342cd6e3cf8433363b0
SHA512bf9a3b647f4b8d26378ca0696f50e9c877ba43cca9936a36eefae0d5b886589230a3b311676a26b5d59e9d1661ef9ed19c6fa5d96d2c7d1850f4e324e0da2819
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
13b3e15ef77a6b9e26c6d0dc9c15fcdf
SHA1e7eeb20d3dbdc5e355c2c5e4a21bdc63fe2384e4
SHA25601d3e85a879cc4f286840acb55fd32e251ca518438e2c342cd6e3cf8433363b0
SHA512bf9a3b647f4b8d26378ca0696f50e9c877ba43cca9936a36eefae0d5b886589230a3b311676a26b5d59e9d1661ef9ed19c6fa5d96d2c7d1850f4e324e0da2819
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
13b3e15ef77a6b9e26c6d0dc9c15fcdf
SHA1e7eeb20d3dbdc5e355c2c5e4a21bdc63fe2384e4
SHA25601d3e85a879cc4f286840acb55fd32e251ca518438e2c342cd6e3cf8433363b0
SHA512bf9a3b647f4b8d26378ca0696f50e9c877ba43cca9936a36eefae0d5b886589230a3b311676a26b5d59e9d1661ef9ed19c6fa5d96d2c7d1850f4e324e0da2819
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
13b3e15ef77a6b9e26c6d0dc9c15fcdf
SHA1e7eeb20d3dbdc5e355c2c5e4a21bdc63fe2384e4
SHA25601d3e85a879cc4f286840acb55fd32e251ca518438e2c342cd6e3cf8433363b0
SHA512bf9a3b647f4b8d26378ca0696f50e9c877ba43cca9936a36eefae0d5b886589230a3b311676a26b5d59e9d1661ef9ed19c6fa5d96d2c7d1850f4e324e0da2819
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
13b3e15ef77a6b9e26c6d0dc9c15fcdf
SHA1e7eeb20d3dbdc5e355c2c5e4a21bdc63fe2384e4
SHA25601d3e85a879cc4f286840acb55fd32e251ca518438e2c342cd6e3cf8433363b0
SHA512bf9a3b647f4b8d26378ca0696f50e9c877ba43cca9936a36eefae0d5b886589230a3b311676a26b5d59e9d1661ef9ed19c6fa5d96d2c7d1850f4e324e0da2819
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
13b3e15ef77a6b9e26c6d0dc9c15fcdf
SHA1e7eeb20d3dbdc5e355c2c5e4a21bdc63fe2384e4
SHA25601d3e85a879cc4f286840acb55fd32e251ca518438e2c342cd6e3cf8433363b0
SHA512bf9a3b647f4b8d26378ca0696f50e9c877ba43cca9936a36eefae0d5b886589230a3b311676a26b5d59e9d1661ef9ed19c6fa5d96d2c7d1850f4e324e0da2819
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
13b3e15ef77a6b9e26c6d0dc9c15fcdf
SHA1e7eeb20d3dbdc5e355c2c5e4a21bdc63fe2384e4
SHA25601d3e85a879cc4f286840acb55fd32e251ca518438e2c342cd6e3cf8433363b0
SHA512bf9a3b647f4b8d26378ca0696f50e9c877ba43cca9936a36eefae0d5b886589230a3b311676a26b5d59e9d1661ef9ed19c6fa5d96d2c7d1850f4e324e0da2819
-
memory/268-84-0x0000000000000000-mapping.dmp
-
memory/368-68-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/368-67-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/368-77-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/368-74-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/368-76-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/368-75-0x0000000000550000-0x0000000000551000-memory.dmpFilesize
4KB
-
memory/368-79-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/368-62-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/368-59-0x0000000000400000-0x000000000054B000-memory.dmpFilesize
1.3MB
-
memory/368-69-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/368-78-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/368-66-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/368-63-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/368-65-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/972-90-0x0000000000000000-mapping.dmp
-
memory/1004-105-0x00000000004085D0-mapping.dmp
-
memory/1172-71-0x00000000004085D0-mapping.dmp
-
memory/1172-81-0x0000000076661000-0x0000000076663000-memory.dmpFilesize
8KB
-
memory/1172-80-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1172-70-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1496-107-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1496-108-0x00000000004B5640-mapping.dmp
-
memory/1496-114-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1496-118-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1772-82-0x0000000000000000-mapping.dmp