Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-05-2021 15:27
Static task
static1
Behavioral task
behavioral1
Sample
3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe
Resource
win10v20210408
General
-
Target
3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe
-
Size
1.9MB
-
MD5
b9c8a214a2d5f76056f475856ea214c6
-
SHA1
4682b1892f3f0ee13f0a2eb702e05fbb3e5d0af3
-
SHA256
3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2
-
SHA512
a98d561e8a4cd669096077171cbe8a0899799cc2cb9d7d54ac7ae0f529e757156f657aa5bd21e85fab3149fd6963b343a3b0a7a4af550b4300277374b9a33852
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
test.exetest.exetest.exepid process 572 test.exe 1040 test.exe 1100 test.exe -
Processes:
resource yara_rule behavioral1/memory/1960-71-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1960-81-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1100-108-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1100-122-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exepid process 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\test\\test.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exetest.exedescription pid process target process PID 1860 set thread context of 1960 1860 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe PID 572 set thread context of 1040 572 test.exe test.exe PID 572 set thread context of 1100 572 test.exe test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
test.exetest.exedescription pid process Token: SeIncreaseQuotaPrivilege 1100 test.exe Token: SeSecurityPrivilege 1100 test.exe Token: SeTakeOwnershipPrivilege 1100 test.exe Token: SeLoadDriverPrivilege 1100 test.exe Token: SeSystemProfilePrivilege 1100 test.exe Token: SeSystemtimePrivilege 1100 test.exe Token: SeProfSingleProcessPrivilege 1100 test.exe Token: SeIncBasePriorityPrivilege 1100 test.exe Token: SeCreatePagefilePrivilege 1100 test.exe Token: SeBackupPrivilege 1100 test.exe Token: SeRestorePrivilege 1100 test.exe Token: SeShutdownPrivilege 1100 test.exe Token: SeDebugPrivilege 1100 test.exe Token: SeSystemEnvironmentPrivilege 1100 test.exe Token: SeChangeNotifyPrivilege 1100 test.exe Token: SeRemoteShutdownPrivilege 1100 test.exe Token: SeUndockPrivilege 1100 test.exe Token: SeManageVolumePrivilege 1100 test.exe Token: SeImpersonatePrivilege 1100 test.exe Token: SeCreateGlobalPrivilege 1100 test.exe Token: 33 1100 test.exe Token: 34 1100 test.exe Token: 35 1100 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe Token: SeDebugPrivilege 1040 test.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exetest.exetest.exepid process 1860 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 572 test.exe 1040 test.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.execmd.exetest.exedescription pid process target process PID 1860 wrote to memory of 1960 1860 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe PID 1860 wrote to memory of 1960 1860 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe PID 1860 wrote to memory of 1960 1860 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe PID 1860 wrote to memory of 1960 1860 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe PID 1860 wrote to memory of 1960 1860 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe PID 1860 wrote to memory of 1960 1860 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe PID 1860 wrote to memory of 1960 1860 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe PID 1860 wrote to memory of 1960 1860 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe PID 1960 wrote to memory of 1676 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe cmd.exe PID 1960 wrote to memory of 1676 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe cmd.exe PID 1960 wrote to memory of 1676 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe cmd.exe PID 1960 wrote to memory of 1676 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe cmd.exe PID 1676 wrote to memory of 1488 1676 cmd.exe reg.exe PID 1676 wrote to memory of 1488 1676 cmd.exe reg.exe PID 1676 wrote to memory of 1488 1676 cmd.exe reg.exe PID 1676 wrote to memory of 1488 1676 cmd.exe reg.exe PID 1960 wrote to memory of 572 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe test.exe PID 1960 wrote to memory of 572 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe test.exe PID 1960 wrote to memory of 572 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe test.exe PID 1960 wrote to memory of 572 1960 3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe test.exe PID 572 wrote to memory of 1040 572 test.exe test.exe PID 572 wrote to memory of 1040 572 test.exe test.exe PID 572 wrote to memory of 1040 572 test.exe test.exe PID 572 wrote to memory of 1040 572 test.exe test.exe PID 572 wrote to memory of 1040 572 test.exe test.exe PID 572 wrote to memory of 1040 572 test.exe test.exe PID 572 wrote to memory of 1040 572 test.exe test.exe PID 572 wrote to memory of 1040 572 test.exe test.exe PID 572 wrote to memory of 1100 572 test.exe test.exe PID 572 wrote to memory of 1100 572 test.exe test.exe PID 572 wrote to memory of 1100 572 test.exe test.exe PID 572 wrote to memory of 1100 572 test.exe test.exe PID 572 wrote to memory of 1100 572 test.exe test.exe PID 572 wrote to memory of 1100 572 test.exe test.exe PID 572 wrote to memory of 1100 572 test.exe test.exe PID 572 wrote to memory of 1100 572 test.exe test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe"C:\Users\Admin\AppData\Local\Temp\3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe"C:\Users\Admin\AppData\Local\Temp\3158c8b8248fe99ce5fc5c265cb3edf1957dee1508a7241d6c54acd283647ee2.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\USRVI.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f4⤵
- Adds Run key to start application
PID:1488 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1040 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1100
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\USRVI.batMD5
527683c48cc4c7190219814c77b72fe0
SHA1d995878a8f4b9824a0508039eeada5376be9a52d
SHA256bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b
SHA512408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
a0487f8049b9be1f2cc0aa8dded1b164
SHA189617a611d267821ad1ba0c57f1a6d2aeb7a35e1
SHA25637f6ca0ae7f82f17840b3e70934616d1d7eec3bd249f4030f5b22888c7ddaf36
SHA512f9d57f719228d630b96f019c98d8c97e487ede17e6a589969c48a77296e9a921f4563c3adeb4f829c7c8e95be1d751e647141b6a0de274b78fa8e7ec5eaddffa
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
a0487f8049b9be1f2cc0aa8dded1b164
SHA189617a611d267821ad1ba0c57f1a6d2aeb7a35e1
SHA25637f6ca0ae7f82f17840b3e70934616d1d7eec3bd249f4030f5b22888c7ddaf36
SHA512f9d57f719228d630b96f019c98d8c97e487ede17e6a589969c48a77296e9a921f4563c3adeb4f829c7c8e95be1d751e647141b6a0de274b78fa8e7ec5eaddffa
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
a0487f8049b9be1f2cc0aa8dded1b164
SHA189617a611d267821ad1ba0c57f1a6d2aeb7a35e1
SHA25637f6ca0ae7f82f17840b3e70934616d1d7eec3bd249f4030f5b22888c7ddaf36
SHA512f9d57f719228d630b96f019c98d8c97e487ede17e6a589969c48a77296e9a921f4563c3adeb4f829c7c8e95be1d751e647141b6a0de274b78fa8e7ec5eaddffa
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
a0487f8049b9be1f2cc0aa8dded1b164
SHA189617a611d267821ad1ba0c57f1a6d2aeb7a35e1
SHA25637f6ca0ae7f82f17840b3e70934616d1d7eec3bd249f4030f5b22888c7ddaf36
SHA512f9d57f719228d630b96f019c98d8c97e487ede17e6a589969c48a77296e9a921f4563c3adeb4f829c7c8e95be1d751e647141b6a0de274b78fa8e7ec5eaddffa
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
a0487f8049b9be1f2cc0aa8dded1b164
SHA189617a611d267821ad1ba0c57f1a6d2aeb7a35e1
SHA25637f6ca0ae7f82f17840b3e70934616d1d7eec3bd249f4030f5b22888c7ddaf36
SHA512f9d57f719228d630b96f019c98d8c97e487ede17e6a589969c48a77296e9a921f4563c3adeb4f829c7c8e95be1d751e647141b6a0de274b78fa8e7ec5eaddffa
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
a0487f8049b9be1f2cc0aa8dded1b164
SHA189617a611d267821ad1ba0c57f1a6d2aeb7a35e1
SHA25637f6ca0ae7f82f17840b3e70934616d1d7eec3bd249f4030f5b22888c7ddaf36
SHA512f9d57f719228d630b96f019c98d8c97e487ede17e6a589969c48a77296e9a921f4563c3adeb4f829c7c8e95be1d751e647141b6a0de274b78fa8e7ec5eaddffa
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
a0487f8049b9be1f2cc0aa8dded1b164
SHA189617a611d267821ad1ba0c57f1a6d2aeb7a35e1
SHA25637f6ca0ae7f82f17840b3e70934616d1d7eec3bd249f4030f5b22888c7ddaf36
SHA512f9d57f719228d630b96f019c98d8c97e487ede17e6a589969c48a77296e9a921f4563c3adeb4f829c7c8e95be1d751e647141b6a0de274b78fa8e7ec5eaddffa
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
a0487f8049b9be1f2cc0aa8dded1b164
SHA189617a611d267821ad1ba0c57f1a6d2aeb7a35e1
SHA25637f6ca0ae7f82f17840b3e70934616d1d7eec3bd249f4030f5b22888c7ddaf36
SHA512f9d57f719228d630b96f019c98d8c97e487ede17e6a589969c48a77296e9a921f4563c3adeb4f829c7c8e95be1d751e647141b6a0de274b78fa8e7ec5eaddffa
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
a0487f8049b9be1f2cc0aa8dded1b164
SHA189617a611d267821ad1ba0c57f1a6d2aeb7a35e1
SHA25637f6ca0ae7f82f17840b3e70934616d1d7eec3bd249f4030f5b22888c7ddaf36
SHA512f9d57f719228d630b96f019c98d8c97e487ede17e6a589969c48a77296e9a921f4563c3adeb4f829c7c8e95be1d751e647141b6a0de274b78fa8e7ec5eaddffa
-
memory/572-91-0x0000000000000000-mapping.dmp
-
memory/1040-106-0x00000000004085D0-mapping.dmp
-
memory/1100-108-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1100-111-0x00000000004B5640-mapping.dmp
-
memory/1100-122-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1100-123-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1488-85-0x0000000000000000-mapping.dmp
-
memory/1676-83-0x0000000000000000-mapping.dmp
-
memory/1860-69-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1860-75-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1860-64-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1860-66-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1860-77-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1860-78-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/1860-79-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1860-80-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1860-63-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1860-67-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1860-76-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1860-70-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1860-60-0x0000000000400000-0x000000000054B000-memory.dmpFilesize
1.3MB
-
memory/1860-68-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1960-82-0x0000000076A81000-0x0000000076A83000-memory.dmpFilesize
8KB
-
memory/1960-71-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1960-72-0x00000000004085D0-mapping.dmp
-
memory/1960-81-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB