Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 12:55
Static task
static1
Behavioral task
behavioral1
Sample
63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe
Resource
win10v20210410
General
-
Target
63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe
-
Size
667KB
-
MD5
52284a58b470d6357c687091e5844125
-
SHA1
f4e9af57952c54cff18e91dbc33600ad5a22662a
-
SHA256
63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd
-
SHA512
914ebbe51e00215beda54a13a5412c4cad7aaec67bd93b3dcc62e28a259eb4ccb550ec179fd7b3ddecfcaec8416dd2d7fa0cd221e1b7a3ad696519c27eaabef9
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\svchost.exe" 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1684 svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe -
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\svchost.exe" 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\svchost.exe" svchost.exe -
Drops file in Windows directory 3 IoCs
Processes:
63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exedescription ioc process File opened for modification C:\Windows\svchost.exe 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe File opened for modification C:\Windows\ 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe File created C:\Windows\svchost.exe 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exesvchost.exedescription pid process Token: SeIncreaseQuotaPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeSecurityPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeTakeOwnershipPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeLoadDriverPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeSystemProfilePrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeSystemtimePrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeProfSingleProcessPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeIncBasePriorityPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeCreatePagefilePrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeBackupPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeRestorePrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeShutdownPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeDebugPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeSystemEnvironmentPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeChangeNotifyPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeRemoteShutdownPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeUndockPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeManageVolumePrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeImpersonatePrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeCreateGlobalPrivilege 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: 33 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: 34 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: 35 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: 36 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe Token: SeIncreaseQuotaPrivilege 1684 svchost.exe Token: SeSecurityPrivilege 1684 svchost.exe Token: SeTakeOwnershipPrivilege 1684 svchost.exe Token: SeLoadDriverPrivilege 1684 svchost.exe Token: SeSystemProfilePrivilege 1684 svchost.exe Token: SeSystemtimePrivilege 1684 svchost.exe Token: SeProfSingleProcessPrivilege 1684 svchost.exe Token: SeIncBasePriorityPrivilege 1684 svchost.exe Token: SeCreatePagefilePrivilege 1684 svchost.exe Token: SeBackupPrivilege 1684 svchost.exe Token: SeRestorePrivilege 1684 svchost.exe Token: SeShutdownPrivilege 1684 svchost.exe Token: SeDebugPrivilege 1684 svchost.exe Token: SeSystemEnvironmentPrivilege 1684 svchost.exe Token: SeChangeNotifyPrivilege 1684 svchost.exe Token: SeRemoteShutdownPrivilege 1684 svchost.exe Token: SeUndockPrivilege 1684 svchost.exe Token: SeManageVolumePrivilege 1684 svchost.exe Token: SeImpersonatePrivilege 1684 svchost.exe Token: SeCreateGlobalPrivilege 1684 svchost.exe Token: 33 1684 svchost.exe Token: 34 1684 svchost.exe Token: 35 1684 svchost.exe Token: 36 1684 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 1684 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exedescription pid process target process PID 3768 wrote to memory of 1684 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe svchost.exe PID 3768 wrote to memory of 1684 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe svchost.exe PID 3768 wrote to memory of 1684 3768 63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe"C:\Users\Admin\AppData\Local\Temp\63d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1684
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\svchost.exeMD5
52284a58b470d6357c687091e5844125
SHA1f4e9af57952c54cff18e91dbc33600ad5a22662a
SHA25663d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd
SHA512914ebbe51e00215beda54a13a5412c4cad7aaec67bd93b3dcc62e28a259eb4ccb550ec179fd7b3ddecfcaec8416dd2d7fa0cd221e1b7a3ad696519c27eaabef9
-
C:\Windows\svchost.exeMD5
52284a58b470d6357c687091e5844125
SHA1f4e9af57952c54cff18e91dbc33600ad5a22662a
SHA25663d70b8cabe3b497be9612ddc8de5e0e1c5f8832a28d2bb4c165096f2c5767dd
SHA512914ebbe51e00215beda54a13a5412c4cad7aaec67bd93b3dcc62e28a259eb4ccb550ec179fd7b3ddecfcaec8416dd2d7fa0cd221e1b7a3ad696519c27eaabef9
-
memory/1684-114-0x0000000000000000-mapping.dmp
-
memory/1684-118-0x00000000004C0000-0x000000000060A000-memory.dmpFilesize
1.3MB
-
memory/3768-117-0x0000000002220000-0x0000000002221000-memory.dmpFilesize
4KB