Analysis
-
max time kernel
150s -
max time network
163s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-05-2021 00:58
Static task
static1
Behavioral task
behavioral1
Sample
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe
Resource
win10v20210408
General
-
Target
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe
-
Size
1.9MB
-
MD5
b642d6bd10be8a0755f7d9b1ec6dc4b4
-
SHA1
4fd2f150c468ab083b9e55f44cf083e7a2c33fdd
-
SHA256
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8
-
SHA512
d302dd8a8d0ded6611824144bfffb1ce41b00db521b89b2c5a0f83e09970e9cbb288f039b6a0f85e112d9301ed2cb0f7b42c42af8913025f6fcbf0d8e5343e16
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
test.exetest.exetest.exepid process 2296 test.exe 364 test.exe 3232 test.exe -
Processes:
resource yara_rule behavioral2/memory/3880-117-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3880-127-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3232-140-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3232-153-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\test\\test.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exetest.exedescription pid process target process PID 472 set thread context of 3880 472 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 2296 set thread context of 364 2296 test.exe test.exe PID 2296 set thread context of 3232 2296 test.exe test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
test.exetest.exedescription pid process Token: SeIncreaseQuotaPrivilege 3232 test.exe Token: SeSecurityPrivilege 3232 test.exe Token: SeTakeOwnershipPrivilege 3232 test.exe Token: SeLoadDriverPrivilege 3232 test.exe Token: SeSystemProfilePrivilege 3232 test.exe Token: SeSystemtimePrivilege 3232 test.exe Token: SeProfSingleProcessPrivilege 3232 test.exe Token: SeIncBasePriorityPrivilege 3232 test.exe Token: SeCreatePagefilePrivilege 3232 test.exe Token: SeBackupPrivilege 3232 test.exe Token: SeRestorePrivilege 3232 test.exe Token: SeShutdownPrivilege 3232 test.exe Token: SeDebugPrivilege 3232 test.exe Token: SeSystemEnvironmentPrivilege 3232 test.exe Token: SeChangeNotifyPrivilege 3232 test.exe Token: SeRemoteShutdownPrivilege 3232 test.exe Token: SeUndockPrivilege 3232 test.exe Token: SeManageVolumePrivilege 3232 test.exe Token: SeImpersonatePrivilege 3232 test.exe Token: SeCreateGlobalPrivilege 3232 test.exe Token: 33 3232 test.exe Token: 34 3232 test.exe Token: 35 3232 test.exe Token: 36 3232 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe Token: SeDebugPrivilege 364 test.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exea3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exetest.exetest.exepid process 472 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe 3880 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe 2296 test.exe 364 test.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exea3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.execmd.exetest.exedescription pid process target process PID 472 wrote to memory of 3880 472 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 472 wrote to memory of 3880 472 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 472 wrote to memory of 3880 472 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 472 wrote to memory of 3880 472 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 472 wrote to memory of 3880 472 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 472 wrote to memory of 3880 472 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 472 wrote to memory of 3880 472 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 472 wrote to memory of 3880 472 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe PID 3880 wrote to memory of 2888 3880 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe cmd.exe PID 3880 wrote to memory of 2888 3880 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe cmd.exe PID 3880 wrote to memory of 2888 3880 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe cmd.exe PID 2888 wrote to memory of 932 2888 cmd.exe reg.exe PID 2888 wrote to memory of 932 2888 cmd.exe reg.exe PID 2888 wrote to memory of 932 2888 cmd.exe reg.exe PID 3880 wrote to memory of 2296 3880 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe test.exe PID 3880 wrote to memory of 2296 3880 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe test.exe PID 3880 wrote to memory of 2296 3880 a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe test.exe PID 2296 wrote to memory of 364 2296 test.exe test.exe PID 2296 wrote to memory of 364 2296 test.exe test.exe PID 2296 wrote to memory of 364 2296 test.exe test.exe PID 2296 wrote to memory of 364 2296 test.exe test.exe PID 2296 wrote to memory of 364 2296 test.exe test.exe PID 2296 wrote to memory of 364 2296 test.exe test.exe PID 2296 wrote to memory of 364 2296 test.exe test.exe PID 2296 wrote to memory of 364 2296 test.exe test.exe PID 2296 wrote to memory of 3232 2296 test.exe test.exe PID 2296 wrote to memory of 3232 2296 test.exe test.exe PID 2296 wrote to memory of 3232 2296 test.exe test.exe PID 2296 wrote to memory of 3232 2296 test.exe test.exe PID 2296 wrote to memory of 3232 2296 test.exe test.exe PID 2296 wrote to memory of 3232 2296 test.exe test.exe PID 2296 wrote to memory of 3232 2296 test.exe test.exe PID 2296 wrote to memory of 3232 2296 test.exe test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe"C:\Users\Admin\AppData\Local\Temp\a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe"C:\Users\Admin\AppData\Local\Temp\a3ea0f7e7ed47a78bd00703e9e6e0a9127b0107b270cf8c25b910bfe3f3872b8.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IVCLV.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f4⤵
- Adds Run key to start application
PID:932 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:364 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3232
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IVCLV.batMD5
527683c48cc4c7190219814c77b72fe0
SHA1d995878a8f4b9824a0508039eeada5376be9a52d
SHA256bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b
SHA512408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
760666a90fce76dd3acf005e323a5ad9
SHA1a925342c668dcd0ebba18be9abb5a2e18751a211
SHA2561b0df9bc0e34fce2138fa195558ba9286b8f57d3686b888466b200280f9557d8
SHA51204abb44f2df8a14781948305cab4f3f970240d7970ab1e5b6109ec4a52f7bab828edfb4b844c61b6eb8e8557e647fbfec9172ea436b64b24335e427bb7d9a4a5
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
760666a90fce76dd3acf005e323a5ad9
SHA1a925342c668dcd0ebba18be9abb5a2e18751a211
SHA2561b0df9bc0e34fce2138fa195558ba9286b8f57d3686b888466b200280f9557d8
SHA51204abb44f2df8a14781948305cab4f3f970240d7970ab1e5b6109ec4a52f7bab828edfb4b844c61b6eb8e8557e647fbfec9172ea436b64b24335e427bb7d9a4a5
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
760666a90fce76dd3acf005e323a5ad9
SHA1a925342c668dcd0ebba18be9abb5a2e18751a211
SHA2561b0df9bc0e34fce2138fa195558ba9286b8f57d3686b888466b200280f9557d8
SHA51204abb44f2df8a14781948305cab4f3f970240d7970ab1e5b6109ec4a52f7bab828edfb4b844c61b6eb8e8557e647fbfec9172ea436b64b24335e427bb7d9a4a5
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
760666a90fce76dd3acf005e323a5ad9
SHA1a925342c668dcd0ebba18be9abb5a2e18751a211
SHA2561b0df9bc0e34fce2138fa195558ba9286b8f57d3686b888466b200280f9557d8
SHA51204abb44f2df8a14781948305cab4f3f970240d7970ab1e5b6109ec4a52f7bab828edfb4b844c61b6eb8e8557e647fbfec9172ea436b64b24335e427bb7d9a4a5
-
memory/364-138-0x00000000004085D0-mapping.dmp
-
memory/472-124-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/472-121-0x0000000002290000-0x0000000002291000-memory.dmpFilesize
4KB
-
memory/472-125-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/472-122-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/472-126-0x0000000002300000-0x0000000002301000-memory.dmpFilesize
4KB
-
memory/472-123-0x00000000022C0000-0x00000000022C1000-memory.dmpFilesize
4KB
-
memory/472-114-0x0000000000400000-0x000000000054B000-memory.dmpFilesize
1.3MB
-
memory/932-130-0x0000000000000000-mapping.dmp
-
memory/2296-131-0x0000000000000000-mapping.dmp
-
memory/2888-128-0x0000000000000000-mapping.dmp
-
memory/3232-140-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3232-141-0x00000000004B5640-mapping.dmp
-
memory/3232-153-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3232-154-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/3880-127-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3880-118-0x00000000004085D0-mapping.dmp
-
memory/3880-117-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB