Analysis
-
max time kernel
151s -
max time network
183s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-05-2021 13:26
Static task
static1
Behavioral task
behavioral1
Sample
963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe
Resource
win10v20210410
General
-
Target
963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe
-
Size
1.9MB
-
MD5
b59b198e170da97221264dda2d1b6d0b
-
SHA1
eb3900951abbd3eeca751f3d6fdb1ba39f58bb6c
-
SHA256
963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e
-
SHA512
4d13e289841a55f51b27d38c7dafbfeaebdba0b9d80c79ebd2018eb56fbff6fc6cac5cc854a509e0858d9c6d24ba3d227b1dcadfdb33ffdac49cc5dc7bc8f7e7
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
test.exetest.exetest.exepid process 824 test.exe 432 test.exe 964 test.exe -
Processes:
resource yara_rule behavioral1/memory/1900-71-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1900-75-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/964-108-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/964-122-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exepid process 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\test\\test.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exetest.exedescription pid process target process PID 1972 set thread context of 1900 1972 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe PID 824 set thread context of 432 824 test.exe test.exe PID 824 set thread context of 964 824 test.exe test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
test.exetest.exedescription pid process Token: SeIncreaseQuotaPrivilege 964 test.exe Token: SeSecurityPrivilege 964 test.exe Token: SeTakeOwnershipPrivilege 964 test.exe Token: SeLoadDriverPrivilege 964 test.exe Token: SeSystemProfilePrivilege 964 test.exe Token: SeSystemtimePrivilege 964 test.exe Token: SeProfSingleProcessPrivilege 964 test.exe Token: SeIncBasePriorityPrivilege 964 test.exe Token: SeCreatePagefilePrivilege 964 test.exe Token: SeBackupPrivilege 964 test.exe Token: SeRestorePrivilege 964 test.exe Token: SeShutdownPrivilege 964 test.exe Token: SeDebugPrivilege 964 test.exe Token: SeSystemEnvironmentPrivilege 964 test.exe Token: SeChangeNotifyPrivilege 964 test.exe Token: SeRemoteShutdownPrivilege 964 test.exe Token: SeUndockPrivilege 964 test.exe Token: SeManageVolumePrivilege 964 test.exe Token: SeImpersonatePrivilege 964 test.exe Token: SeCreateGlobalPrivilege 964 test.exe Token: 33 964 test.exe Token: 34 964 test.exe Token: 35 964 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe Token: SeDebugPrivilege 432 test.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exetest.exetest.exepid process 1972 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 824 test.exe 432 test.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.execmd.exetest.exedescription pid process target process PID 1972 wrote to memory of 1900 1972 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe PID 1972 wrote to memory of 1900 1972 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe PID 1972 wrote to memory of 1900 1972 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe PID 1972 wrote to memory of 1900 1972 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe PID 1972 wrote to memory of 1900 1972 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe PID 1972 wrote to memory of 1900 1972 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe PID 1972 wrote to memory of 1900 1972 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe PID 1972 wrote to memory of 1900 1972 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe PID 1900 wrote to memory of 316 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe cmd.exe PID 1900 wrote to memory of 316 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe cmd.exe PID 1900 wrote to memory of 316 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe cmd.exe PID 1900 wrote to memory of 316 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe cmd.exe PID 316 wrote to memory of 1388 316 cmd.exe reg.exe PID 316 wrote to memory of 1388 316 cmd.exe reg.exe PID 316 wrote to memory of 1388 316 cmd.exe reg.exe PID 316 wrote to memory of 1388 316 cmd.exe reg.exe PID 1900 wrote to memory of 824 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe test.exe PID 1900 wrote to memory of 824 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe test.exe PID 1900 wrote to memory of 824 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe test.exe PID 1900 wrote to memory of 824 1900 963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe test.exe PID 824 wrote to memory of 432 824 test.exe test.exe PID 824 wrote to memory of 432 824 test.exe test.exe PID 824 wrote to memory of 432 824 test.exe test.exe PID 824 wrote to memory of 432 824 test.exe test.exe PID 824 wrote to memory of 432 824 test.exe test.exe PID 824 wrote to memory of 432 824 test.exe test.exe PID 824 wrote to memory of 432 824 test.exe test.exe PID 824 wrote to memory of 432 824 test.exe test.exe PID 824 wrote to memory of 964 824 test.exe test.exe PID 824 wrote to memory of 964 824 test.exe test.exe PID 824 wrote to memory of 964 824 test.exe test.exe PID 824 wrote to memory of 964 824 test.exe test.exe PID 824 wrote to memory of 964 824 test.exe test.exe PID 824 wrote to memory of 964 824 test.exe test.exe PID 824 wrote to memory of 964 824 test.exe test.exe PID 824 wrote to memory of 964 824 test.exe test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe"C:\Users\Admin\AppData\Local\Temp\963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe"C:\Users\Admin\AppData\Local\Temp\963ad0005f9082bae33060722c0725ee50a4464c08229fc6376514a07dab348e.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\GBYWA.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f4⤵
- Adds Run key to start application
PID:1388 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:432 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GBYWA.batMD5
527683c48cc4c7190219814c77b72fe0
SHA1d995878a8f4b9824a0508039eeada5376be9a52d
SHA256bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b
SHA512408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
5c1fba3a94bd84c29f68d4639425eabf
SHA1d8ff701826ad42f4d8c76bdd2a72db3eaa48a682
SHA256ec467a1e344c1057a45a4a8bfe5d37fa6240edb729904c634d26ab9ee6685827
SHA512c0098a10800cfbd58a284b0fe994bc8fcbc3bc0a6f154eadab9e0b7656df28e547c2fb37a161aaae60f1120ad5d94f93d7c378d479331096262c925af6275934
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
5c1fba3a94bd84c29f68d4639425eabf
SHA1d8ff701826ad42f4d8c76bdd2a72db3eaa48a682
SHA256ec467a1e344c1057a45a4a8bfe5d37fa6240edb729904c634d26ab9ee6685827
SHA512c0098a10800cfbd58a284b0fe994bc8fcbc3bc0a6f154eadab9e0b7656df28e547c2fb37a161aaae60f1120ad5d94f93d7c378d479331096262c925af6275934
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
5c1fba3a94bd84c29f68d4639425eabf
SHA1d8ff701826ad42f4d8c76bdd2a72db3eaa48a682
SHA256ec467a1e344c1057a45a4a8bfe5d37fa6240edb729904c634d26ab9ee6685827
SHA512c0098a10800cfbd58a284b0fe994bc8fcbc3bc0a6f154eadab9e0b7656df28e547c2fb37a161aaae60f1120ad5d94f93d7c378d479331096262c925af6275934
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
5c1fba3a94bd84c29f68d4639425eabf
SHA1d8ff701826ad42f4d8c76bdd2a72db3eaa48a682
SHA256ec467a1e344c1057a45a4a8bfe5d37fa6240edb729904c634d26ab9ee6685827
SHA512c0098a10800cfbd58a284b0fe994bc8fcbc3bc0a6f154eadab9e0b7656df28e547c2fb37a161aaae60f1120ad5d94f93d7c378d479331096262c925af6275934
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
5c1fba3a94bd84c29f68d4639425eabf
SHA1d8ff701826ad42f4d8c76bdd2a72db3eaa48a682
SHA256ec467a1e344c1057a45a4a8bfe5d37fa6240edb729904c634d26ab9ee6685827
SHA512c0098a10800cfbd58a284b0fe994bc8fcbc3bc0a6f154eadab9e0b7656df28e547c2fb37a161aaae60f1120ad5d94f93d7c378d479331096262c925af6275934
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
5c1fba3a94bd84c29f68d4639425eabf
SHA1d8ff701826ad42f4d8c76bdd2a72db3eaa48a682
SHA256ec467a1e344c1057a45a4a8bfe5d37fa6240edb729904c634d26ab9ee6685827
SHA512c0098a10800cfbd58a284b0fe994bc8fcbc3bc0a6f154eadab9e0b7656df28e547c2fb37a161aaae60f1120ad5d94f93d7c378d479331096262c925af6275934
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
5c1fba3a94bd84c29f68d4639425eabf
SHA1d8ff701826ad42f4d8c76bdd2a72db3eaa48a682
SHA256ec467a1e344c1057a45a4a8bfe5d37fa6240edb729904c634d26ab9ee6685827
SHA512c0098a10800cfbd58a284b0fe994bc8fcbc3bc0a6f154eadab9e0b7656df28e547c2fb37a161aaae60f1120ad5d94f93d7c378d479331096262c925af6275934
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
5c1fba3a94bd84c29f68d4639425eabf
SHA1d8ff701826ad42f4d8c76bdd2a72db3eaa48a682
SHA256ec467a1e344c1057a45a4a8bfe5d37fa6240edb729904c634d26ab9ee6685827
SHA512c0098a10800cfbd58a284b0fe994bc8fcbc3bc0a6f154eadab9e0b7656df28e547c2fb37a161aaae60f1120ad5d94f93d7c378d479331096262c925af6275934
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
5c1fba3a94bd84c29f68d4639425eabf
SHA1d8ff701826ad42f4d8c76bdd2a72db3eaa48a682
SHA256ec467a1e344c1057a45a4a8bfe5d37fa6240edb729904c634d26ab9ee6685827
SHA512c0098a10800cfbd58a284b0fe994bc8fcbc3bc0a6f154eadab9e0b7656df28e547c2fb37a161aaae60f1120ad5d94f93d7c378d479331096262c925af6275934
-
memory/316-83-0x0000000000000000-mapping.dmp
-
memory/432-106-0x00000000004085D0-mapping.dmp
-
memory/824-91-0x0000000000000000-mapping.dmp
-
memory/964-122-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/964-123-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/964-110-0x00000000004B5640-mapping.dmp
-
memory/964-108-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1388-85-0x0000000000000000-mapping.dmp
-
memory/1900-82-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB
-
memory/1900-75-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1900-72-0x00000000004085D0-mapping.dmp
-
memory/1900-71-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1972-67-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1972-79-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1972-70-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1972-69-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1972-68-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1972-73-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1972-66-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1972-74-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1972-64-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1972-81-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/1972-63-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1972-77-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/1972-76-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1972-60-0x0000000000400000-0x000000000054B000-memory.dmpFilesize
1.3MB