Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
15-05-2021 04:44
Static task
static1
Behavioral task
behavioral1
Sample
ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe
Resource
win10v20210410
General
-
Target
ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe
-
Size
1.9MB
-
MD5
ba3851b7a3b93b34ab082dd184b01969
-
SHA1
04a9cf0d8a973c9de96dae6fd830f9780512424d
-
SHA256
ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1
-
SHA512
4765f079e434990360f34c3bf8c90d9e48ba0ff988a3a2d2edacf30085eb6a8ce10af3677d199a5830bd80278965674afac15e79438872946d2213268324e121
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
test.exetest.exetest.exepid process 988 test.exe 3672 test.exe 3776 test.exe -
Processes:
resource yara_rule behavioral2/memory/2168-117-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2168-120-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3776-140-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3776-153-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\test\\test.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exetest.exedescription pid process target process PID 3892 set thread context of 2168 3892 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe PID 988 set thread context of 3672 988 test.exe test.exe PID 988 set thread context of 3776 988 test.exe test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
test.exetest.exedescription pid process Token: SeIncreaseQuotaPrivilege 3776 test.exe Token: SeSecurityPrivilege 3776 test.exe Token: SeTakeOwnershipPrivilege 3776 test.exe Token: SeLoadDriverPrivilege 3776 test.exe Token: SeSystemProfilePrivilege 3776 test.exe Token: SeSystemtimePrivilege 3776 test.exe Token: SeProfSingleProcessPrivilege 3776 test.exe Token: SeIncBasePriorityPrivilege 3776 test.exe Token: SeCreatePagefilePrivilege 3776 test.exe Token: SeBackupPrivilege 3776 test.exe Token: SeRestorePrivilege 3776 test.exe Token: SeShutdownPrivilege 3776 test.exe Token: SeDebugPrivilege 3776 test.exe Token: SeSystemEnvironmentPrivilege 3776 test.exe Token: SeChangeNotifyPrivilege 3776 test.exe Token: SeRemoteShutdownPrivilege 3776 test.exe Token: SeUndockPrivilege 3776 test.exe Token: SeManageVolumePrivilege 3776 test.exe Token: SeImpersonatePrivilege 3776 test.exe Token: SeCreateGlobalPrivilege 3776 test.exe Token: 33 3776 test.exe Token: 34 3776 test.exe Token: 35 3776 test.exe Token: 36 3776 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe Token: SeDebugPrivilege 3672 test.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exeac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exetest.exetest.exepid process 3892 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe 2168 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe 988 test.exe 3672 test.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exeac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.execmd.exetest.exedescription pid process target process PID 3892 wrote to memory of 2168 3892 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe PID 3892 wrote to memory of 2168 3892 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe PID 3892 wrote to memory of 2168 3892 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe PID 3892 wrote to memory of 2168 3892 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe PID 3892 wrote to memory of 2168 3892 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe PID 3892 wrote to memory of 2168 3892 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe PID 3892 wrote to memory of 2168 3892 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe PID 3892 wrote to memory of 2168 3892 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe PID 2168 wrote to memory of 196 2168 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe cmd.exe PID 2168 wrote to memory of 196 2168 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe cmd.exe PID 2168 wrote to memory of 196 2168 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe cmd.exe PID 196 wrote to memory of 688 196 cmd.exe reg.exe PID 196 wrote to memory of 688 196 cmd.exe reg.exe PID 196 wrote to memory of 688 196 cmd.exe reg.exe PID 2168 wrote to memory of 988 2168 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe test.exe PID 2168 wrote to memory of 988 2168 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe test.exe PID 2168 wrote to memory of 988 2168 ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe test.exe PID 988 wrote to memory of 3672 988 test.exe test.exe PID 988 wrote to memory of 3672 988 test.exe test.exe PID 988 wrote to memory of 3672 988 test.exe test.exe PID 988 wrote to memory of 3672 988 test.exe test.exe PID 988 wrote to memory of 3672 988 test.exe test.exe PID 988 wrote to memory of 3672 988 test.exe test.exe PID 988 wrote to memory of 3672 988 test.exe test.exe PID 988 wrote to memory of 3672 988 test.exe test.exe PID 988 wrote to memory of 3776 988 test.exe test.exe PID 988 wrote to memory of 3776 988 test.exe test.exe PID 988 wrote to memory of 3776 988 test.exe test.exe PID 988 wrote to memory of 3776 988 test.exe test.exe PID 988 wrote to memory of 3776 988 test.exe test.exe PID 988 wrote to memory of 3776 988 test.exe test.exe PID 988 wrote to memory of 3776 988 test.exe test.exe PID 988 wrote to memory of 3776 988 test.exe test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe"C:\Users\Admin\AppData\Local\Temp\ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe"C:\Users\Admin\AppData\Local\Temp\ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RFCQQ.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:196 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f4⤵
- Adds Run key to start application
PID:688 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3672 -
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3776
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
527683c48cc4c7190219814c77b72fe0
SHA1d995878a8f4b9824a0508039eeada5376be9a52d
SHA256bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b
SHA512408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6
-
MD5
78e9bb6a1372b920494c62f4315981e8
SHA16c8e076b63408c085d6e5e8be87565c3b2c19f8b
SHA2562a5199f0353435da7d56f5333069a8b68a1816db93956cbee32bcf0f7a494d59
SHA512f10d4db8190954692ecc900b85fd0366de26956c3c453005ddfb093f4faf8779e0bd471722ce2d8b67f421b2833b72a2808207cff419906bae24d1f8f9b55584
-
MD5
78e9bb6a1372b920494c62f4315981e8
SHA16c8e076b63408c085d6e5e8be87565c3b2c19f8b
SHA2562a5199f0353435da7d56f5333069a8b68a1816db93956cbee32bcf0f7a494d59
SHA512f10d4db8190954692ecc900b85fd0366de26956c3c453005ddfb093f4faf8779e0bd471722ce2d8b67f421b2833b72a2808207cff419906bae24d1f8f9b55584
-
MD5
78e9bb6a1372b920494c62f4315981e8
SHA16c8e076b63408c085d6e5e8be87565c3b2c19f8b
SHA2562a5199f0353435da7d56f5333069a8b68a1816db93956cbee32bcf0f7a494d59
SHA512f10d4db8190954692ecc900b85fd0366de26956c3c453005ddfb093f4faf8779e0bd471722ce2d8b67f421b2833b72a2808207cff419906bae24d1f8f9b55584
-
MD5
78e9bb6a1372b920494c62f4315981e8
SHA16c8e076b63408c085d6e5e8be87565c3b2c19f8b
SHA2562a5199f0353435da7d56f5333069a8b68a1816db93956cbee32bcf0f7a494d59
SHA512f10d4db8190954692ecc900b85fd0366de26956c3c453005ddfb093f4faf8779e0bd471722ce2d8b67f421b2833b72a2808207cff419906bae24d1f8f9b55584