Analysis
-
max time kernel
150s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-05-2021 11:19
Static task
static1
Behavioral task
behavioral1
Sample
d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe
Resource
win10v20210410
General
-
Target
d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe
-
Size
1.9MB
-
MD5
39c4e0d317be94dd90138cbba7009f50
-
SHA1
f606d43b09f51620415a749fea1da7f33b652ebb
-
SHA256
d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f
-
SHA512
f7115ddeca1b6a70ff9c67e2a76f230a59f818815dba791d9dfd6cd9a764a3b0a38d1661cf0074b54ab93124c917859ee6fc9683dc236e395aef1dc68f902620
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
test.exetest.exetest.exepid process 340 test.exe 1508 test.exe 296 test.exe -
Processes:
resource yara_rule behavioral1/memory/2016-70-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2016-73-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/296-107-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/296-114-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exepid process 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\test\\test.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exetest.exedescription pid process target process PID 772 set thread context of 2016 772 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe PID 340 set thread context of 1508 340 test.exe test.exe PID 340 set thread context of 296 340 test.exe test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
test.exetest.exedescription pid process Token: SeIncreaseQuotaPrivilege 296 test.exe Token: SeSecurityPrivilege 296 test.exe Token: SeTakeOwnershipPrivilege 296 test.exe Token: SeLoadDriverPrivilege 296 test.exe Token: SeSystemProfilePrivilege 296 test.exe Token: SeSystemtimePrivilege 296 test.exe Token: SeProfSingleProcessPrivilege 296 test.exe Token: SeIncBasePriorityPrivilege 296 test.exe Token: SeCreatePagefilePrivilege 296 test.exe Token: SeBackupPrivilege 296 test.exe Token: SeRestorePrivilege 296 test.exe Token: SeShutdownPrivilege 296 test.exe Token: SeDebugPrivilege 296 test.exe Token: SeSystemEnvironmentPrivilege 296 test.exe Token: SeChangeNotifyPrivilege 296 test.exe Token: SeRemoteShutdownPrivilege 296 test.exe Token: SeUndockPrivilege 296 test.exe Token: SeManageVolumePrivilege 296 test.exe Token: SeImpersonatePrivilege 296 test.exe Token: SeCreateGlobalPrivilege 296 test.exe Token: 33 296 test.exe Token: 34 296 test.exe Token: 35 296 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe Token: SeDebugPrivilege 1508 test.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exed3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exetest.exetest.exepid process 772 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe 340 test.exe 1508 test.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exed3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.execmd.exetest.exedescription pid process target process PID 772 wrote to memory of 2016 772 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe PID 772 wrote to memory of 2016 772 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe PID 772 wrote to memory of 2016 772 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe PID 772 wrote to memory of 2016 772 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe PID 772 wrote to memory of 2016 772 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe PID 772 wrote to memory of 2016 772 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe PID 772 wrote to memory of 2016 772 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe PID 772 wrote to memory of 2016 772 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe PID 2016 wrote to memory of 1584 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe cmd.exe PID 2016 wrote to memory of 1584 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe cmd.exe PID 2016 wrote to memory of 1584 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe cmd.exe PID 2016 wrote to memory of 1584 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe cmd.exe PID 1584 wrote to memory of 528 1584 cmd.exe reg.exe PID 1584 wrote to memory of 528 1584 cmd.exe reg.exe PID 1584 wrote to memory of 528 1584 cmd.exe reg.exe PID 1584 wrote to memory of 528 1584 cmd.exe reg.exe PID 2016 wrote to memory of 340 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe test.exe PID 2016 wrote to memory of 340 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe test.exe PID 2016 wrote to memory of 340 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe test.exe PID 2016 wrote to memory of 340 2016 d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe test.exe PID 340 wrote to memory of 1508 340 test.exe test.exe PID 340 wrote to memory of 1508 340 test.exe test.exe PID 340 wrote to memory of 1508 340 test.exe test.exe PID 340 wrote to memory of 1508 340 test.exe test.exe PID 340 wrote to memory of 1508 340 test.exe test.exe PID 340 wrote to memory of 1508 340 test.exe test.exe PID 340 wrote to memory of 1508 340 test.exe test.exe PID 340 wrote to memory of 1508 340 test.exe test.exe PID 340 wrote to memory of 296 340 test.exe test.exe PID 340 wrote to memory of 296 340 test.exe test.exe PID 340 wrote to memory of 296 340 test.exe test.exe PID 340 wrote to memory of 296 340 test.exe test.exe PID 340 wrote to memory of 296 340 test.exe test.exe PID 340 wrote to memory of 296 340 test.exe test.exe PID 340 wrote to memory of 296 340 test.exe test.exe PID 340 wrote to memory of 296 340 test.exe test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe"C:\Users\Admin\AppData\Local\Temp\d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe"C:\Users\Admin\AppData\Local\Temp\d3089f6b3b583203c76258ec3a0c55ea78fca7fa84e91261922f73b54766ca2f.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\FJYAY.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f4⤵
- Adds Run key to start application
PID:528 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1508 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:296
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FJYAY.batMD5
527683c48cc4c7190219814c77b72fe0
SHA1d995878a8f4b9824a0508039eeada5376be9a52d
SHA256bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b
SHA512408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
41da08f565dd77df43fe4533c6fac902
SHA1c6107726832c9a49b57909d81ac7490ab1f8b274
SHA256944db08ea4eea471e6d903e47a761cadd580c4bb67e02974eb5297031602b1de
SHA5120eebc84e769b944ad81bc00aca04dec3f32cf7d33542e99af0e65cfd3d392c74d1d6e531e22814d354d59203bb1fb171ba716f9d202493ac285c3ec626447c57
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
41da08f565dd77df43fe4533c6fac902
SHA1c6107726832c9a49b57909d81ac7490ab1f8b274
SHA256944db08ea4eea471e6d903e47a761cadd580c4bb67e02974eb5297031602b1de
SHA5120eebc84e769b944ad81bc00aca04dec3f32cf7d33542e99af0e65cfd3d392c74d1d6e531e22814d354d59203bb1fb171ba716f9d202493ac285c3ec626447c57
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
41da08f565dd77df43fe4533c6fac902
SHA1c6107726832c9a49b57909d81ac7490ab1f8b274
SHA256944db08ea4eea471e6d903e47a761cadd580c4bb67e02974eb5297031602b1de
SHA5120eebc84e769b944ad81bc00aca04dec3f32cf7d33542e99af0e65cfd3d392c74d1d6e531e22814d354d59203bb1fb171ba716f9d202493ac285c3ec626447c57
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
41da08f565dd77df43fe4533c6fac902
SHA1c6107726832c9a49b57909d81ac7490ab1f8b274
SHA256944db08ea4eea471e6d903e47a761cadd580c4bb67e02974eb5297031602b1de
SHA5120eebc84e769b944ad81bc00aca04dec3f32cf7d33542e99af0e65cfd3d392c74d1d6e531e22814d354d59203bb1fb171ba716f9d202493ac285c3ec626447c57
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
41da08f565dd77df43fe4533c6fac902
SHA1c6107726832c9a49b57909d81ac7490ab1f8b274
SHA256944db08ea4eea471e6d903e47a761cadd580c4bb67e02974eb5297031602b1de
SHA5120eebc84e769b944ad81bc00aca04dec3f32cf7d33542e99af0e65cfd3d392c74d1d6e531e22814d354d59203bb1fb171ba716f9d202493ac285c3ec626447c57
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
41da08f565dd77df43fe4533c6fac902
SHA1c6107726832c9a49b57909d81ac7490ab1f8b274
SHA256944db08ea4eea471e6d903e47a761cadd580c4bb67e02974eb5297031602b1de
SHA5120eebc84e769b944ad81bc00aca04dec3f32cf7d33542e99af0e65cfd3d392c74d1d6e531e22814d354d59203bb1fb171ba716f9d202493ac285c3ec626447c57
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
41da08f565dd77df43fe4533c6fac902
SHA1c6107726832c9a49b57909d81ac7490ab1f8b274
SHA256944db08ea4eea471e6d903e47a761cadd580c4bb67e02974eb5297031602b1de
SHA5120eebc84e769b944ad81bc00aca04dec3f32cf7d33542e99af0e65cfd3d392c74d1d6e531e22814d354d59203bb1fb171ba716f9d202493ac285c3ec626447c57
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
41da08f565dd77df43fe4533c6fac902
SHA1c6107726832c9a49b57909d81ac7490ab1f8b274
SHA256944db08ea4eea471e6d903e47a761cadd580c4bb67e02974eb5297031602b1de
SHA5120eebc84e769b944ad81bc00aca04dec3f32cf7d33542e99af0e65cfd3d392c74d1d6e531e22814d354d59203bb1fb171ba716f9d202493ac285c3ec626447c57
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
41da08f565dd77df43fe4533c6fac902
SHA1c6107726832c9a49b57909d81ac7490ab1f8b274
SHA256944db08ea4eea471e6d903e47a761cadd580c4bb67e02974eb5297031602b1de
SHA5120eebc84e769b944ad81bc00aca04dec3f32cf7d33542e99af0e65cfd3d392c74d1d6e531e22814d354d59203bb1fb171ba716f9d202493ac285c3ec626447c57
-
memory/296-108-0x00000000004B5640-mapping.dmp
-
memory/296-115-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/296-114-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/296-107-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/340-90-0x0000000000000000-mapping.dmp
-
memory/528-84-0x0000000000000000-mapping.dmp
-
memory/772-69-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/772-67-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/772-59-0x0000000000400000-0x000000000054B000-memory.dmpFilesize
1.3MB
-
memory/772-78-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/772-77-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/772-76-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/772-75-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/772-62-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/772-72-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/772-68-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/772-79-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/772-66-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/772-65-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/772-63-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1508-105-0x00000000004085D0-mapping.dmp
-
memory/1584-82-0x0000000000000000-mapping.dmp
-
memory/2016-81-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/2016-73-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2016-71-0x00000000004085D0-mapping.dmp
-
memory/2016-70-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB