Analysis

  • max time kernel
    151s
  • max time network
    131s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    13-05-2021 06:17

General

  • Target

    6a6ec0d82d0d124e65e4a0cd9c7262e51def7dfb4ed43398a41d1ec3508cee88.exe

  • Size

    343KB

  • MD5

    6cf1ef6ae9f35d89efbae669e3fa59cf

  • SHA1

    a19ce57386dae3750e7e326a024da77717047d7d

  • SHA256

    6a6ec0d82d0d124e65e4a0cd9c7262e51def7dfb4ed43398a41d1ec3508cee88

  • SHA512

    abd59863bae3c8342e1583adc5df2ad383b0b3273d18da52aba1b2dec815f2415fc2bd4ded90c18a5a16c37ba9d1defe86432457111fbf10b5b95ba0861824e7

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Executes dropped EXE 3 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\6a6ec0d82d0d124e65e4a0cd9c7262e51def7dfb4ed43398a41d1ec3508cee88.exe
      "C:\Users\Admin\AppData\Local\Temp\6a6ec0d82d0d124e65e4a0cd9c7262e51def7dfb4ed43398a41d1ec3508cee88.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:636
      • C:\Users\Admin\AppData\Roaming\attrrcfg\dllhhelp.exe
        "C:\Users\Admin\AppData\Roaming\attrrcfg\dllhhelp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3668
        • C:\Users\Admin\AppData\Local\Temp\~D680.tmp
          "C:\Users\Admin\AppData\Local\Temp\~D680.tmp"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3132
      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\~D6BE.tmp.doc" /o ""
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:2864
  • C:\Windows\SysWOW64\Laungman.exe
    C:\Windows\SysWOW64\Laungman.exe -k
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:3500

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/636-114-0x0000000000900000-0x0000000000969000-memory.dmp

    Filesize

    420KB

  • memory/2864-131-0x00007FFF717A0000-0x00007FFF742C3000-memory.dmp

    Filesize

    43.1MB

  • memory/2864-136-0x00007FFF6A6E0000-0x00007FFF6C5D5000-memory.dmp

    Filesize

    31.0MB

  • memory/2864-135-0x00007FFF6CDF0000-0x00007FFF6DEDE000-memory.dmp

    Filesize

    16.9MB

  • memory/2864-127-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

    Filesize

    64KB

  • memory/2864-128-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

    Filesize

    64KB

  • memory/2864-129-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

    Filesize

    64KB

  • memory/2864-130-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

    Filesize

    64KB

  • memory/2864-132-0x00007FFF50D30000-0x00007FFF50D40000-memory.dmp

    Filesize

    64KB

  • memory/2996-125-0x0000000000E20000-0x0000000000E63000-memory.dmp

    Filesize

    268KB

  • memory/2996-201-0x00000000010C0000-0x00000000010D0000-memory.dmp

    Filesize

    64KB

  • memory/2996-209-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-212-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-211-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-195-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-196-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-197-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-198-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-194-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

    Filesize

    64KB

  • memory/2996-200-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-210-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-199-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-203-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-204-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-205-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-206-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-207-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/2996-208-0x00000000010C0000-0x00000000010D0000-memory.dmp

    Filesize

    64KB

  • memory/2996-202-0x0000000000EF0000-0x0000000000F00000-memory.dmp

    Filesize

    64KB

  • memory/3500-124-0x0000000000B50000-0x0000000000BB9000-memory.dmp

    Filesize

    420KB

  • memory/3668-123-0x0000000000B10000-0x0000000000B50000-memory.dmp

    Filesize

    256KB