Analysis
-
max time kernel
150s -
max time network
196s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13/05/2021, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe
-
Size
6.2MB
-
MD5
a92bdf7da1feb431b92c3bd0e5ef990a
-
SHA1
957a25e2cf3c408246427ab565db52dc358cd4e7
-
SHA256
62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6
-
SHA512
cb85dc1914d0f7cab7f8d2a6868ffd55b5aeeeb0afe4b5d87481be696b277974e70feafe97c601a171718f6a0182b034c32f6c511869a94182923be3ee98d1d5
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System64\\1systemsmss.exe, explorer.exe" 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe" 1systemsmss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe" 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe -
Executes dropped EXE 7 IoCs
pid Process 656 1systemsmss.exe 624 svnhost.exe 1156 svnhost.exe 1744 svnhost.exe 944 svnhost.exe 864 systemsmss.exe 1864 systemsmss.exe -
Loads dropped DLL 5 IoCs
pid Process 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 656 1systemsmss.exe 572 cmd.exe 944 svnhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run 1systemsmss.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\System64\systemsmss.exe 1systemsmss.exe File created C:\Windows\Zont911\Tupe.bat 1systemsmss.exe File created C:\Windows\System64\1systemsmss.exe 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe File created C:\Windows\Zont911\Home.zip 1systemsmss.exe File created C:\Windows\System64\vp8decoder.dll 1systemsmss.exe File opened for modification C:\Windows\System64\vp8decoder.dll 1systemsmss.exe File created C:\Windows\System64\vp8encoder.dll 1systemsmss.exe File opened for modification C:\Windows\System64\svnhost.exe 1systemsmss.exe File opened for modification C:\Windows\System64\1systemsmss.exe 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe File created C:\Windows\Zont911\Regedit.reg 1systemsmss.exe File opened for modification C:\Windows\System64\vp8encoder.dll 1systemsmss.exe File created C:\Windows\System64\svnhost.exe 1systemsmss.exe File opened for modification C:\Windows\System64\systemsmss.exe 1systemsmss.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs .reg file with regedit 1 IoCs
pid Process 1020 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe 656 1systemsmss.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 624 svnhost.exe Token: SeDebugPrivilege 1744 svnhost.exe Token: SeTakeOwnershipPrivilege 944 svnhost.exe Token: SeTcbPrivilege 944 svnhost.exe Token: SeTcbPrivilege 944 svnhost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 624 svnhost.exe 1156 svnhost.exe 1744 svnhost.exe 944 svnhost.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1992 wrote to memory of 656 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 29 PID 1992 wrote to memory of 656 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 29 PID 1992 wrote to memory of 656 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 29 PID 1992 wrote to memory of 656 1992 62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe 29 PID 656 wrote to memory of 1020 656 1systemsmss.exe 30 PID 656 wrote to memory of 1020 656 1systemsmss.exe 30 PID 656 wrote to memory of 1020 656 1systemsmss.exe 30 PID 656 wrote to memory of 1020 656 1systemsmss.exe 30 PID 656 wrote to memory of 572 656 1systemsmss.exe 31 PID 656 wrote to memory of 572 656 1systemsmss.exe 31 PID 656 wrote to memory of 572 656 1systemsmss.exe 31 PID 656 wrote to memory of 572 656 1systemsmss.exe 31 PID 572 wrote to memory of 1900 572 cmd.exe 33 PID 572 wrote to memory of 1900 572 cmd.exe 33 PID 572 wrote to memory of 1900 572 cmd.exe 33 PID 572 wrote to memory of 1900 572 cmd.exe 33 PID 572 wrote to memory of 624 572 cmd.exe 34 PID 572 wrote to memory of 624 572 cmd.exe 34 PID 572 wrote to memory of 624 572 cmd.exe 34 PID 572 wrote to memory of 624 572 cmd.exe 34 PID 572 wrote to memory of 1156 572 cmd.exe 35 PID 572 wrote to memory of 1156 572 cmd.exe 35 PID 572 wrote to memory of 1156 572 cmd.exe 35 PID 572 wrote to memory of 1156 572 cmd.exe 35 PID 572 wrote to memory of 1744 572 cmd.exe 36 PID 572 wrote to memory of 1744 572 cmd.exe 36 PID 572 wrote to memory of 1744 572 cmd.exe 36 PID 572 wrote to memory of 1744 572 cmd.exe 36 PID 944 wrote to memory of 864 944 svnhost.exe 38 PID 944 wrote to memory of 864 944 svnhost.exe 38 PID 944 wrote to memory of 864 944 svnhost.exe 38 PID 944 wrote to memory of 864 944 svnhost.exe 38 PID 944 wrote to memory of 1864 944 svnhost.exe 39 PID 944 wrote to memory of 1864 944 svnhost.exe 39 PID 944 wrote to memory of 1864 944 svnhost.exe 39 PID 944 wrote to memory of 1864 944 svnhost.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe"C:\Users\Admin\AppData\Local\Temp\62da1ea6f12737a24733de2657eeba7557fa25c41766befec5c830d5dafe09b6.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\System64\1systemsmss.exe"C:\Windows\System64\1systemsmss.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"3⤵
- Runs .reg file with regedit
PID:1020
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Windows\Zont911\Tupe.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\chcp.comChcp 12514⤵PID:1900
-
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /silentinstall4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:624
-
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /firewall4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1156
-
-
C:\Windows\System64\svnhost.exe"C:\Windows\System64\svnhost.exe" /start4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1744
-
-
-
-
C:\Windows\System64\svnhost.exeC:\Windows\System64\svnhost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\System64\systemsmss.exeC:\Windows\System64\systemsmss.exe2⤵
- Executes dropped EXE
PID:864
-
-
C:\Windows\System64\systemsmss.exeC:\Windows\System64\systemsmss.exe /tray2⤵
- Executes dropped EXE
PID:1864
-