Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
14-05-2021 15:25
Static task
static1
Behavioral task
behavioral1
Sample
62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe
Resource
win10v20210410
General
-
Target
62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe
-
Size
1.5MB
-
MD5
bc6a79b6114ed8f1121008aeb8528e22
-
SHA1
fc34e6014ff7aa79ffb6744aa1c02506c5162f30
-
SHA256
62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f
-
SHA512
f5034cf4764bea453dce20d8cc4e0bedad66fa018817f8a520560e4fa012c67466b802646d345092881ebd1aa4c728a2b885f18dd61b385731761649ef427f85
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
test.exetest.exetest.exepid process 4072 test.exe 1300 test.exe 700 test.exe -
Processes:
resource yara_rule behavioral2/memory/212-119-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/212-127-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/700-140-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/700-153-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\test\\test.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exetest.exedescription pid process target process PID 3172 set thread context of 212 3172 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe PID 4072 set thread context of 1300 4072 test.exe test.exe PID 4072 set thread context of 700 4072 test.exe test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
test.exetest.exedescription pid process Token: SeIncreaseQuotaPrivilege 700 test.exe Token: SeSecurityPrivilege 700 test.exe Token: SeTakeOwnershipPrivilege 700 test.exe Token: SeLoadDriverPrivilege 700 test.exe Token: SeSystemProfilePrivilege 700 test.exe Token: SeSystemtimePrivilege 700 test.exe Token: SeProfSingleProcessPrivilege 700 test.exe Token: SeIncBasePriorityPrivilege 700 test.exe Token: SeCreatePagefilePrivilege 700 test.exe Token: SeBackupPrivilege 700 test.exe Token: SeRestorePrivilege 700 test.exe Token: SeShutdownPrivilege 700 test.exe Token: SeDebugPrivilege 700 test.exe Token: SeSystemEnvironmentPrivilege 700 test.exe Token: SeChangeNotifyPrivilege 700 test.exe Token: SeRemoteShutdownPrivilege 700 test.exe Token: SeUndockPrivilege 700 test.exe Token: SeManageVolumePrivilege 700 test.exe Token: SeImpersonatePrivilege 700 test.exe Token: SeCreateGlobalPrivilege 700 test.exe Token: 33 700 test.exe Token: 34 700 test.exe Token: 35 700 test.exe Token: 36 700 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe Token: SeDebugPrivilege 1300 test.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exetest.exetest.exepid process 3172 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe 212 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe 4072 test.exe 1300 test.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.execmd.exetest.exedescription pid process target process PID 3172 wrote to memory of 212 3172 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe PID 3172 wrote to memory of 212 3172 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe PID 3172 wrote to memory of 212 3172 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe PID 3172 wrote to memory of 212 3172 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe PID 3172 wrote to memory of 212 3172 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe PID 3172 wrote to memory of 212 3172 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe PID 3172 wrote to memory of 212 3172 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe PID 3172 wrote to memory of 212 3172 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe PID 212 wrote to memory of 2552 212 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe cmd.exe PID 212 wrote to memory of 2552 212 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe cmd.exe PID 212 wrote to memory of 2552 212 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe cmd.exe PID 2552 wrote to memory of 2128 2552 cmd.exe reg.exe PID 2552 wrote to memory of 2128 2552 cmd.exe reg.exe PID 2552 wrote to memory of 2128 2552 cmd.exe reg.exe PID 212 wrote to memory of 4072 212 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe test.exe PID 212 wrote to memory of 4072 212 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe test.exe PID 212 wrote to memory of 4072 212 62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe test.exe PID 4072 wrote to memory of 1300 4072 test.exe test.exe PID 4072 wrote to memory of 1300 4072 test.exe test.exe PID 4072 wrote to memory of 1300 4072 test.exe test.exe PID 4072 wrote to memory of 1300 4072 test.exe test.exe PID 4072 wrote to memory of 1300 4072 test.exe test.exe PID 4072 wrote to memory of 1300 4072 test.exe test.exe PID 4072 wrote to memory of 1300 4072 test.exe test.exe PID 4072 wrote to memory of 1300 4072 test.exe test.exe PID 4072 wrote to memory of 700 4072 test.exe test.exe PID 4072 wrote to memory of 700 4072 test.exe test.exe PID 4072 wrote to memory of 700 4072 test.exe test.exe PID 4072 wrote to memory of 700 4072 test.exe test.exe PID 4072 wrote to memory of 700 4072 test.exe test.exe PID 4072 wrote to memory of 700 4072 test.exe test.exe PID 4072 wrote to memory of 700 4072 test.exe test.exe PID 4072 wrote to memory of 700 4072 test.exe test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe"C:\Users\Admin\AppData\Local\Temp\62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe"C:\Users\Admin\AppData\Local\Temp\62095329f455650fecd65d699b6a3c5e63fe16b04ad5f09eaef8f9f671f18c5f.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FQOMQ.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FQOMQ.batMD5
527683c48cc4c7190219814c77b72fe0
SHA1d995878a8f4b9824a0508039eeada5376be9a52d
SHA256bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b
SHA512408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
ad36a87890b51757f54284fd29c0dced
SHA13ba7b965c494052c2f6b170f9c65586f4bf4ce44
SHA256779917879ac7660488033bdcd42de5f0cb5c45646beca62942e6707d599f61ba
SHA512344c151ae60792ec3c0a5bc6474844e128c7591db7f230e29dde8d96e77e9bd1985ba01fd728df983767a71cdb7ac2586d0bd74878015d3f170346603020859c
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
ad36a87890b51757f54284fd29c0dced
SHA13ba7b965c494052c2f6b170f9c65586f4bf4ce44
SHA256779917879ac7660488033bdcd42de5f0cb5c45646beca62942e6707d599f61ba
SHA512344c151ae60792ec3c0a5bc6474844e128c7591db7f230e29dde8d96e77e9bd1985ba01fd728df983767a71cdb7ac2586d0bd74878015d3f170346603020859c
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
ad36a87890b51757f54284fd29c0dced
SHA13ba7b965c494052c2f6b170f9c65586f4bf4ce44
SHA256779917879ac7660488033bdcd42de5f0cb5c45646beca62942e6707d599f61ba
SHA512344c151ae60792ec3c0a5bc6474844e128c7591db7f230e29dde8d96e77e9bd1985ba01fd728df983767a71cdb7ac2586d0bd74878015d3f170346603020859c
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
ad36a87890b51757f54284fd29c0dced
SHA13ba7b965c494052c2f6b170f9c65586f4bf4ce44
SHA256779917879ac7660488033bdcd42de5f0cb5c45646beca62942e6707d599f61ba
SHA512344c151ae60792ec3c0a5bc6474844e128c7591db7f230e29dde8d96e77e9bd1985ba01fd728df983767a71cdb7ac2586d0bd74878015d3f170346603020859c
-
memory/212-127-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/212-120-0x00000000004085D0-mapping.dmp
-
memory/212-119-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/700-141-0x00000000004B5640-mapping.dmp
-
memory/700-140-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/700-153-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/700-154-0x0000000000560000-0x000000000060E000-memory.dmpFilesize
696KB
-
memory/1300-138-0x00000000004085D0-mapping.dmp
-
memory/2128-130-0x0000000000000000-mapping.dmp
-
memory/2552-128-0x0000000000000000-mapping.dmp
-
memory/3172-126-0x0000000002940000-0x0000000002941000-memory.dmpFilesize
4KB
-
memory/3172-117-0x0000000000690000-0x00000000007DA000-memory.dmpFilesize
1.3MB
-
memory/3172-125-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/3172-114-0x0000000000400000-0x000000000054B000-memory.dmpFilesize
1.3MB
-
memory/3172-123-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/3172-124-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/3172-118-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/4072-146-0x0000000000610000-0x000000000075A000-memory.dmpFilesize
1.3MB
-
memory/4072-147-0x0000000000610000-0x000000000075A000-memory.dmpFilesize
1.3MB
-
memory/4072-148-0x0000000000610000-0x000000000075A000-memory.dmpFilesize
1.3MB
-
memory/4072-149-0x0000000000610000-0x000000000075A000-memory.dmpFilesize
1.3MB
-
memory/4072-150-0x0000000000610000-0x000000000075A000-memory.dmpFilesize
1.3MB
-
memory/4072-131-0x0000000000000000-mapping.dmp
-
memory/4072-145-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB