Analysis
-
max time kernel
150s -
max time network
184s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-05-2021 00:58
Static task
static1
Behavioral task
behavioral1
Sample
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe
Resource
win10v20210408
General
-
Target
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe
-
Size
1.9MB
-
MD5
b642d6bd10be8a0755f7d9b1ec6dc4b4
-
SHA1
4fd2f150c468ab083b9e55f44cf083e7a2c33fdd
-
SHA256
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8
-
SHA512
d302dd8a8d0ded6611824144bfffb1ce41b00db521b89b2c5a0f83e09970e9cbb288f039b6a0f85e112d9301ed2cb0f7b42c42af8913025f6fcbf0d8e5343e16
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
test.exetest.exetest.exepid process 1872 test.exe 432 test.exe 1472 test.exe -
Processes:
resource yara_rule behavioral1/memory/1836-72-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1836-80-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1472-107-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1472-121-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exepid process 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\test\\test.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exetest.exedescription pid process target process PID 1648 set thread context of 1836 1648 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 1872 set thread context of 432 1872 test.exe test.exe PID 1872 set thread context of 1472 1872 test.exe test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
test.exetest.exedescription pid process Token: SeIncreaseQuotaPrivilege 1472 test.exe Token: SeSecurityPrivilege 1472 test.exe Token: SeTakeOwnershipPrivilege 1472 test.exe Token: SeLoadDriverPrivilege 1472 test.exe Token: SeSystemProfilePrivilege 1472 test.exe Token: SeSystemtimePrivilege 1472 test.exe Token: SeProfSingleProcessPrivilege 1472 test.exe Token: SeIncBasePriorityPrivilege 1472 test.exe Token: SeCreatePagefilePrivilege 1472 test.exe Token: SeBackupPrivilege 1472 test.exe Token: SeRestorePrivilege 1472 test.exe Token: SeShutdownPrivilege 1472 test.exe Token: SeDebugPrivilege 1472 test.exe Token: SeSystemEnvironmentPrivilege 1472 test.exe Token: SeChangeNotifyPrivilege 1472 test.exe Token: SeRemoteShutdownPrivilege 1472 test.exe Token: SeUndockPrivilege 1472 test.exe Token: SeManageVolumePrivilege 1472 test.exe Token: SeImpersonatePrivilege 1472 test.exe Token: SeCreateGlobalPrivilege 1472 test.exe Token: 33 1472 test.exe Token: 34 1472 test.exe Token: 35 1472 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exea3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exetest.exetest.exepid process 1648 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe 1872 test.exe 432 test.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exea3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.execmd.exetest.exedescription pid process target process PID 1648 wrote to memory of 1836 1648 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 1648 wrote to memory of 1836 1648 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 1648 wrote to memory of 1836 1648 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 1648 wrote to memory of 1836 1648 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 1648 wrote to memory of 1836 1648 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 1648 wrote to memory of 1836 1648 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 1648 wrote to memory of 1836 1648 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 1648 wrote to memory of 1836 1648 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 1836 wrote to memory of 584 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe cmd.exe PID 1836 wrote to memory of 584 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe cmd.exe PID 1836 wrote to memory of 584 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe cmd.exe PID 1836 wrote to memory of 584 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe cmd.exe PID 584 wrote to memory of 568 584 cmd.exe reg.exe PID 584 wrote to memory of 568 584 cmd.exe reg.exe PID 584 wrote to memory of 568 584 cmd.exe reg.exe PID 584 wrote to memory of 568 584 cmd.exe reg.exe PID 1836 wrote to memory of 1872 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe test.exe PID 1836 wrote to memory of 1872 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe test.exe PID 1836 wrote to memory of 1872 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe test.exe PID 1836 wrote to memory of 1872 1836 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe test.exe PID 1872 wrote to memory of 432 1872 test.exe test.exe PID 1872 wrote to memory of 432 1872 test.exe test.exe PID 1872 wrote to memory of 432 1872 test.exe test.exe PID 1872 wrote to memory of 432 1872 test.exe test.exe PID 1872 wrote to memory of 432 1872 test.exe test.exe PID 1872 wrote to memory of 432 1872 test.exe test.exe PID 1872 wrote to memory of 432 1872 test.exe test.exe PID 1872 wrote to memory of 432 1872 test.exe test.exe PID 1872 wrote to memory of 1472 1872 test.exe test.exe PID 1872 wrote to memory of 1472 1872 test.exe test.exe PID 1872 wrote to memory of 1472 1872 test.exe test.exe PID 1872 wrote to memory of 1472 1872 test.exe test.exe PID 1872 wrote to memory of 1472 1872 test.exe test.exe PID 1872 wrote to memory of 1472 1872 test.exe test.exe PID 1872 wrote to memory of 1472 1872 test.exe test.exe PID 1872 wrote to memory of 1472 1872 test.exe test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe"C:\Users\Admin\AppData\Local\Temp\a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe"C:\Users\Admin\AppData\Local\Temp\a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\PQNVI.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f4⤵
- Adds Run key to start application
PID:568 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:432 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1472
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PQNVI.batMD5
527683c48cc4c7190219814c77b72fe0
SHA1d995878a8f4b9824a0508039eeada5376be9a52d
SHA256bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b
SHA512408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
e7425e7c55841910a37467a0f34cca24
SHA11c56ed6dcb9c97cbf15defba71f041b1f530b419
SHA256acb742b7e359499c99784406a1deef741c7483faea8824b70389171d0ab32765
SHA512bc64615778a8093f98a718258ba9cda3f8a73abd2b6fb3862287a7eff71a6b4eb71ad7d4ea65fecfb63ca43905c3d39b2fa838d303685b09f7905f0adf9ddc98
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
e7425e7c55841910a37467a0f34cca24
SHA11c56ed6dcb9c97cbf15defba71f041b1f530b419
SHA256acb742b7e359499c99784406a1deef741c7483faea8824b70389171d0ab32765
SHA512bc64615778a8093f98a718258ba9cda3f8a73abd2b6fb3862287a7eff71a6b4eb71ad7d4ea65fecfb63ca43905c3d39b2fa838d303685b09f7905f0adf9ddc98
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
e7425e7c55841910a37467a0f34cca24
SHA11c56ed6dcb9c97cbf15defba71f041b1f530b419
SHA256acb742b7e359499c99784406a1deef741c7483faea8824b70389171d0ab32765
SHA512bc64615778a8093f98a718258ba9cda3f8a73abd2b6fb3862287a7eff71a6b4eb71ad7d4ea65fecfb63ca43905c3d39b2fa838d303685b09f7905f0adf9ddc98
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
e7425e7c55841910a37467a0f34cca24
SHA11c56ed6dcb9c97cbf15defba71f041b1f530b419
SHA256acb742b7e359499c99784406a1deef741c7483faea8824b70389171d0ab32765
SHA512bc64615778a8093f98a718258ba9cda3f8a73abd2b6fb3862287a7eff71a6b4eb71ad7d4ea65fecfb63ca43905c3d39b2fa838d303685b09f7905f0adf9ddc98
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
e7425e7c55841910a37467a0f34cca24
SHA11c56ed6dcb9c97cbf15defba71f041b1f530b419
SHA256acb742b7e359499c99784406a1deef741c7483faea8824b70389171d0ab32765
SHA512bc64615778a8093f98a718258ba9cda3f8a73abd2b6fb3862287a7eff71a6b4eb71ad7d4ea65fecfb63ca43905c3d39b2fa838d303685b09f7905f0adf9ddc98
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
e7425e7c55841910a37467a0f34cca24
SHA11c56ed6dcb9c97cbf15defba71f041b1f530b419
SHA256acb742b7e359499c99784406a1deef741c7483faea8824b70389171d0ab32765
SHA512bc64615778a8093f98a718258ba9cda3f8a73abd2b6fb3862287a7eff71a6b4eb71ad7d4ea65fecfb63ca43905c3d39b2fa838d303685b09f7905f0adf9ddc98
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
e7425e7c55841910a37467a0f34cca24
SHA11c56ed6dcb9c97cbf15defba71f041b1f530b419
SHA256acb742b7e359499c99784406a1deef741c7483faea8824b70389171d0ab32765
SHA512bc64615778a8093f98a718258ba9cda3f8a73abd2b6fb3862287a7eff71a6b4eb71ad7d4ea65fecfb63ca43905c3d39b2fa838d303685b09f7905f0adf9ddc98
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
e7425e7c55841910a37467a0f34cca24
SHA11c56ed6dcb9c97cbf15defba71f041b1f530b419
SHA256acb742b7e359499c99784406a1deef741c7483faea8824b70389171d0ab32765
SHA512bc64615778a8093f98a718258ba9cda3f8a73abd2b6fb3862287a7eff71a6b4eb71ad7d4ea65fecfb63ca43905c3d39b2fa838d303685b09f7905f0adf9ddc98
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
e7425e7c55841910a37467a0f34cca24
SHA11c56ed6dcb9c97cbf15defba71f041b1f530b419
SHA256acb742b7e359499c99784406a1deef741c7483faea8824b70389171d0ab32765
SHA512bc64615778a8093f98a718258ba9cda3f8a73abd2b6fb3862287a7eff71a6b4eb71ad7d4ea65fecfb63ca43905c3d39b2fa838d303685b09f7905f0adf9ddc98
-
memory/432-105-0x00000000004085D0-mapping.dmp
-
memory/568-84-0x0000000000000000-mapping.dmp
-
memory/584-82-0x0000000000000000-mapping.dmp
-
memory/1472-107-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1472-121-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1472-122-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1472-108-0x00000000004B5640-mapping.dmp
-
memory/1648-70-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1648-68-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1648-76-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1648-79-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/1648-62-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1648-71-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/1648-77-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1648-78-0x0000000000550000-0x0000000000551000-memory.dmpFilesize
4KB
-
memory/1648-69-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1648-59-0x0000000000400000-0x000000000054B000-memory.dmpFilesize
1.3MB
-
memory/1648-67-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1648-66-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1648-65-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1648-63-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1836-81-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/1836-72-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1836-73-0x00000000004085D0-mapping.dmp
-
memory/1836-80-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1872-90-0x0000000000000000-mapping.dmp