Analysis
-
max time kernel
151s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-05-2021 06:17
General
-
Target
6a6ec0d82d0d124e65e4a0cd9c7262e51def7dfb4ed43398a41d1ec3508cee88.exe
-
Size
343KB
-
MD5
6cf1ef6ae9f35d89efbae669e3fa59cf
-
SHA1
a19ce57386dae3750e7e326a024da77717047d7d
-
SHA256
6a6ec0d82d0d124e65e4a0cd9c7262e51def7dfb4ed43398a41d1ec3508cee88
-
SHA512
abd59863bae3c8342e1583adc5df2ad383b0b3273d18da52aba1b2dec815f2415fc2bd4ded90c18a5a16c37ba9d1defe86432457111fbf10b5b95ba0861824e7
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 3 IoCs
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\6a6ec0d82d0d124e65e4a0cd9c7262e51def7dfb4ed43398a41d1ec3508cee88.exe"C:\Users\Admin\AppData\Local\Temp\6a6ec0d82d0d124e65e4a0cd9c7262e51def7dfb4ed43398a41d1ec3508cee88.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\attrrcfg\dllhhelp.exe"C:\Users\Admin\AppData\Roaming\attrrcfg\dllhhelp.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~D680.tmp"C:\Users\Admin\AppData\Local\Temp\~D680.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\~D6BE.tmp.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Laungman.exeC:\Windows\SysWOW64\Laungman.exe -k1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
0715d8c9d313277842927df89ce0d57e
SHA1e7d461747ed40f7ebf843475df35432122f4c386
SHA256695780a282565835535396be705633569858a18eaa728067ba0f98e23420386a
SHA5127cd2ac3a20a425d87468964f52e6e440b35e49838866618cc1584425076610a81a52b0c01e3f1fb38ed3d165f4a1abe87ab6e10d5441fd9f3eb33c261a2d3c00
-
MD5
0715d8c9d313277842927df89ce0d57e
SHA1e7d461747ed40f7ebf843475df35432122f4c386
SHA256695780a282565835535396be705633569858a18eaa728067ba0f98e23420386a
SHA5127cd2ac3a20a425d87468964f52e6e440b35e49838866618cc1584425076610a81a52b0c01e3f1fb38ed3d165f4a1abe87ab6e10d5441fd9f3eb33c261a2d3c00
-
MD5
7d5a60d00374d3a30b057a14e9620010
SHA16cdc63abda3aabb9b895042e5a3ab1adac706c07
SHA2569c8c0a5b14ae306533c4391dc700f8adf7b6dbdd7afc582ba031ea34d072aaca
SHA512d3ffa37623a7d49f1ecf70fe514af247da6fea8e7b5f5aca57f2de903182f99990112f533f82fecb3d41d6ff4e39a8fdac97c48d711d341710de909befd0dcb0
-
MD5
73d0c3f91da66d59ecba468b0bbfd85f
SHA16376f4020bdbf2456b39128eefd227cd65cb982d
SHA256ee75ddf27fc7d0d5afcaea06c2ec0ce2f2e4f202d4a6b327b8540154578a438c
SHA5127398bfa1129a21626ac9a04c1004e643c645ec1b9bb7c8f520942e4e399123c8d080218b78ef067320b66fccb99540075a337d37b3cd785b29e48412588ede8c
-
MD5
c6c4e5cc3eb7822cbb7a55e8b45fae26
SHA19dc0bf40dc41bef2ed38c0255d33a3723125db08
SHA25631ea3cd0f29f637d0252e3a9e1b4f06f2abd8d1ba2bb5c1fb4ecb009aca0521c
SHA512c73a40dc8b94817eb893cc25f5193427b249f55e1acd273f06112660b9cebe4b5a8a561a421b75329870ebae56e84c7f72b6930b0fed895c1fb38869f86cc605
-
MD5
c6c4e5cc3eb7822cbb7a55e8b45fae26
SHA19dc0bf40dc41bef2ed38c0255d33a3723125db08
SHA25631ea3cd0f29f637d0252e3a9e1b4f06f2abd8d1ba2bb5c1fb4ecb009aca0521c
SHA512c73a40dc8b94817eb893cc25f5193427b249f55e1acd273f06112660b9cebe4b5a8a561a421b75329870ebae56e84c7f72b6930b0fed895c1fb38869f86cc605
-
MD5
6cf1ef6ae9f35d89efbae669e3fa59cf
SHA1a19ce57386dae3750e7e326a024da77717047d7d
SHA2566a6ec0d82d0d124e65e4a0cd9c7262e51def7dfb4ed43398a41d1ec3508cee88
SHA512abd59863bae3c8342e1583adc5df2ad383b0b3273d18da52aba1b2dec815f2415fc2bd4ded90c18a5a16c37ba9d1defe86432457111fbf10b5b95ba0861824e7
-
MD5
6cf1ef6ae9f35d89efbae669e3fa59cf
SHA1a19ce57386dae3750e7e326a024da77717047d7d
SHA2566a6ec0d82d0d124e65e4a0cd9c7262e51def7dfb4ed43398a41d1ec3508cee88
SHA512abd59863bae3c8342e1583adc5df2ad383b0b3273d18da52aba1b2dec815f2415fc2bd4ded90c18a5a16c37ba9d1defe86432457111fbf10b5b95ba0861824e7
-
Filesize
420KB
-
Filesize
43.1MB
-
Filesize
31.0MB
-
Filesize
16.9MB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
268KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
420KB
-
Filesize
256KB
-