Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 11:10
General
-
Target
6bfaff1d987b257a2cecada27743464472ccc1a3099ea4dce9fc124664a8c77d.exe
-
Size
507KB
-
MD5
56a65bdcd8ac98ea90b9aec9bfe2b5e4
-
SHA1
189fde58d647edd83940de632dde978dd7a3823c
-
SHA256
6bfaff1d987b257a2cecada27743464472ccc1a3099ea4dce9fc124664a8c77d
-
SHA512
3005d1336e7abc98323635422c149d3d35eebf950a1cebb08e91db43896dca765d73635d786d37fdc1b6f209aeee1e84370570e9b35368642929aace33228e2f
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 3 IoCs
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\6bfaff1d987b257a2cecada27743464472ccc1a3099ea4dce9fc124664a8c77d.exe"C:\Users\Admin\AppData\Local\Temp\6bfaff1d987b257a2cecada27743464472ccc1a3099ea4dce9fc124664a8c77d.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ddodpand\clicasks.exe"C:\Users\Admin\AppData\Roaming\ddodpand\clicasks.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~F48.tmp"C:\Users\Admin\AppData\Local\Temp\~F48.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\~FC5.tmp.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\evenlwiz.exeC:\Windows\SysWOW64\evenlwiz.exe -k1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
9616998334154666128a23b5befb9c75
SHA18d15f964fc999993672279b0f7f0d2e3fb3cd409
SHA2561786928fc22ffd7a54681fa6e917b8f85f9fc0b5d8eee2a167b5faf7e6c9a84e
SHA5124e24d758193cc374f5954f0093935103dd2d15b6b65de2c06420455c29adc870595dcb7fa491a7e4d6d7555b9c6a0bf413024a06a29c435068eee966f110c363
-
MD5
9616998334154666128a23b5befb9c75
SHA18d15f964fc999993672279b0f7f0d2e3fb3cd409
SHA2561786928fc22ffd7a54681fa6e917b8f85f9fc0b5d8eee2a167b5faf7e6c9a84e
SHA5124e24d758193cc374f5954f0093935103dd2d15b6b65de2c06420455c29adc870595dcb7fa491a7e4d6d7555b9c6a0bf413024a06a29c435068eee966f110c363
-
MD5
149f0098b9faa6bcf9a8f7f2aed29fc9
SHA1244de26e12de2d715cf3a869e932a6d21b3a8b1e
SHA25634969e2f18eae8c5b9bf68dbfe92aeee74c05206237498231d03d95a0ed1941f
SHA512f98135fcaff860b66bf73fa46fb72375a5b9ee8865af113b793a85eaa5bc020c3f716c9b2709252008978071fd02be620428be8e39fefdd533a0cc3e1c207056
-
MD5
7f1d98d03afe344a89cd4f71ca5209ed
SHA12861a07173c85f26d35cf4fc199a7da05d7e3354
SHA25685a2e6155ca66a1feb4fc92238a1b34bf42b3380afc773b2b76501a96ba5c710
SHA512dcc596a1761c97660888e68475991ef6d05085533962d0f6554d842a279136ca6a8b9aa85b54b91cb853f9bdac3518d6b18671e129adec26555ace576395b224
-
MD5
b0e552fecaed717807ea6412e4e496eb
SHA106d802d2f52849f934f0f6720adc959086e90851
SHA25605ddf734e417de65703fecd20004c92933dc53788c910c349dd72fd7fc8ce5f9
SHA512d86d796630727a6992761178aedd5fb4c491ab9a8ff8226a428428235e24712ec4c4ead36376b685e903c78dff3a1e7b0014cf17417ede4adc344954146bbacd
-
MD5
b0e552fecaed717807ea6412e4e496eb
SHA106d802d2f52849f934f0f6720adc959086e90851
SHA25605ddf734e417de65703fecd20004c92933dc53788c910c349dd72fd7fc8ce5f9
SHA512d86d796630727a6992761178aedd5fb4c491ab9a8ff8226a428428235e24712ec4c4ead36376b685e903c78dff3a1e7b0014cf17417ede4adc344954146bbacd
-
MD5
56a65bdcd8ac98ea90b9aec9bfe2b5e4
SHA1189fde58d647edd83940de632dde978dd7a3823c
SHA2566bfaff1d987b257a2cecada27743464472ccc1a3099ea4dce9fc124664a8c77d
SHA5123005d1336e7abc98323635422c149d3d35eebf950a1cebb08e91db43896dca765d73635d786d37fdc1b6f209aeee1e84370570e9b35368642929aace33228e2f
-
MD5
56a65bdcd8ac98ea90b9aec9bfe2b5e4
SHA1189fde58d647edd83940de632dde978dd7a3823c
SHA2566bfaff1d987b257a2cecada27743464472ccc1a3099ea4dce9fc124664a8c77d
SHA5123005d1336e7abc98323635422c149d3d35eebf950a1cebb08e91db43896dca765d73635d786d37fdc1b6f209aeee1e84370570e9b35368642929aace33228e2f
-
Filesize
584KB
-
-
-
Filesize
1.3MB
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
43.1MB
-
Filesize
16.9MB
-
Filesize
31.0MB
-
-
Filesize
268KB