Analysis
-
max time kernel
151s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
16-05-2021 02:51
Static task
static1
Behavioral task
behavioral1
Sample
cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe
Resource
win10v20210410
General
-
Target
cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe
-
Size
1.9MB
-
MD5
c8e40b0239e76e084d28b19e611700df
-
SHA1
a4166c99927fccfb4338c3902439fca15c4a26d9
-
SHA256
cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608
-
SHA512
e7e067720ae7860a7f75af6b041ea3aff58191a875a553d6c93eddb73339228fa9c9364c3872b288cd935ec43ba9f965a4efaaa4de2893f57b447bf9f7bc90d5
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
test.exetest.exetest.exepid process 320 test.exe 328 test.exe 864 test.exe -
Processes:
resource yara_rule behavioral1/memory/1908-74-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1908-70-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/864-111-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/864-121-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exepid process 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\test\\test.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exetest.exedescription pid process target process PID 1084 set thread context of 1908 1084 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe PID 320 set thread context of 328 320 test.exe test.exe PID 320 set thread context of 864 320 test.exe test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
test.exetest.exedescription pid process Token: SeIncreaseQuotaPrivilege 864 test.exe Token: SeSecurityPrivilege 864 test.exe Token: SeTakeOwnershipPrivilege 864 test.exe Token: SeLoadDriverPrivilege 864 test.exe Token: SeSystemProfilePrivilege 864 test.exe Token: SeSystemtimePrivilege 864 test.exe Token: SeProfSingleProcessPrivilege 864 test.exe Token: SeIncBasePriorityPrivilege 864 test.exe Token: SeCreatePagefilePrivilege 864 test.exe Token: SeBackupPrivilege 864 test.exe Token: SeRestorePrivilege 864 test.exe Token: SeShutdownPrivilege 864 test.exe Token: SeDebugPrivilege 864 test.exe Token: SeSystemEnvironmentPrivilege 864 test.exe Token: SeChangeNotifyPrivilege 864 test.exe Token: SeRemoteShutdownPrivilege 864 test.exe Token: SeUndockPrivilege 864 test.exe Token: SeManageVolumePrivilege 864 test.exe Token: SeImpersonatePrivilege 864 test.exe Token: SeCreateGlobalPrivilege 864 test.exe Token: 33 864 test.exe Token: 34 864 test.exe Token: 35 864 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe Token: SeDebugPrivilege 328 test.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.execf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exetest.exetest.exepid process 1084 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe 320 test.exe 328 test.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.execf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.execmd.exetest.exedescription pid process target process PID 1084 wrote to memory of 1908 1084 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe PID 1084 wrote to memory of 1908 1084 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe PID 1084 wrote to memory of 1908 1084 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe PID 1084 wrote to memory of 1908 1084 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe PID 1084 wrote to memory of 1908 1084 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe PID 1084 wrote to memory of 1908 1084 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe PID 1084 wrote to memory of 1908 1084 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe PID 1084 wrote to memory of 1908 1084 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe PID 1908 wrote to memory of 728 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cmd.exe PID 1908 wrote to memory of 728 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cmd.exe PID 1908 wrote to memory of 728 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cmd.exe PID 1908 wrote to memory of 728 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe cmd.exe PID 728 wrote to memory of 1176 728 cmd.exe reg.exe PID 728 wrote to memory of 1176 728 cmd.exe reg.exe PID 728 wrote to memory of 1176 728 cmd.exe reg.exe PID 728 wrote to memory of 1176 728 cmd.exe reg.exe PID 1908 wrote to memory of 320 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe test.exe PID 1908 wrote to memory of 320 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe test.exe PID 1908 wrote to memory of 320 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe test.exe PID 1908 wrote to memory of 320 1908 cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe test.exe PID 320 wrote to memory of 328 320 test.exe test.exe PID 320 wrote to memory of 328 320 test.exe test.exe PID 320 wrote to memory of 328 320 test.exe test.exe PID 320 wrote to memory of 328 320 test.exe test.exe PID 320 wrote to memory of 328 320 test.exe test.exe PID 320 wrote to memory of 328 320 test.exe test.exe PID 320 wrote to memory of 328 320 test.exe test.exe PID 320 wrote to memory of 328 320 test.exe test.exe PID 320 wrote to memory of 864 320 test.exe test.exe PID 320 wrote to memory of 864 320 test.exe test.exe PID 320 wrote to memory of 864 320 test.exe test.exe PID 320 wrote to memory of 864 320 test.exe test.exe PID 320 wrote to memory of 864 320 test.exe test.exe PID 320 wrote to memory of 864 320 test.exe test.exe PID 320 wrote to memory of 864 320 test.exe test.exe PID 320 wrote to memory of 864 320 test.exe test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe"C:\Users\Admin\AppData\Local\Temp\cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe"C:\Users\Admin\AppData\Local\Temp\cf9e19205571c0dc595854b01d2292939517f469e19f28724a5db8c3f728b608.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\SANMH.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SANMH.batMD5
527683c48cc4c7190219814c77b72fe0
SHA1d995878a8f4b9824a0508039eeada5376be9a52d
SHA256bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b
SHA512408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
a602395fde9398f10e2d22892c71ebf0
SHA1a2462293369bd887d9bf92c26263473e2e77cffe
SHA256397df290b6068bbf7ba86c08a102c037bcf4294dcd65c8b45f8600a8af032e09
SHA5125d9307682ed2d5ccf77f4d5d12deca987b46e205abb6bd220074536b726a12e8ba04f547d40a95dcf65d2a88237f460e5738625d933426d06dd6e4e212b6b25c
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
a602395fde9398f10e2d22892c71ebf0
SHA1a2462293369bd887d9bf92c26263473e2e77cffe
SHA256397df290b6068bbf7ba86c08a102c037bcf4294dcd65c8b45f8600a8af032e09
SHA5125d9307682ed2d5ccf77f4d5d12deca987b46e205abb6bd220074536b726a12e8ba04f547d40a95dcf65d2a88237f460e5738625d933426d06dd6e4e212b6b25c
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
a602395fde9398f10e2d22892c71ebf0
SHA1a2462293369bd887d9bf92c26263473e2e77cffe
SHA256397df290b6068bbf7ba86c08a102c037bcf4294dcd65c8b45f8600a8af032e09
SHA5125d9307682ed2d5ccf77f4d5d12deca987b46e205abb6bd220074536b726a12e8ba04f547d40a95dcf65d2a88237f460e5738625d933426d06dd6e4e212b6b25c
-
C:\Users\Admin\AppData\Roaming\test\test.exeMD5
a602395fde9398f10e2d22892c71ebf0
SHA1a2462293369bd887d9bf92c26263473e2e77cffe
SHA256397df290b6068bbf7ba86c08a102c037bcf4294dcd65c8b45f8600a8af032e09
SHA5125d9307682ed2d5ccf77f4d5d12deca987b46e205abb6bd220074536b726a12e8ba04f547d40a95dcf65d2a88237f460e5738625d933426d06dd6e4e212b6b25c
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
a602395fde9398f10e2d22892c71ebf0
SHA1a2462293369bd887d9bf92c26263473e2e77cffe
SHA256397df290b6068bbf7ba86c08a102c037bcf4294dcd65c8b45f8600a8af032e09
SHA5125d9307682ed2d5ccf77f4d5d12deca987b46e205abb6bd220074536b726a12e8ba04f547d40a95dcf65d2a88237f460e5738625d933426d06dd6e4e212b6b25c
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
a602395fde9398f10e2d22892c71ebf0
SHA1a2462293369bd887d9bf92c26263473e2e77cffe
SHA256397df290b6068bbf7ba86c08a102c037bcf4294dcd65c8b45f8600a8af032e09
SHA5125d9307682ed2d5ccf77f4d5d12deca987b46e205abb6bd220074536b726a12e8ba04f547d40a95dcf65d2a88237f460e5738625d933426d06dd6e4e212b6b25c
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
a602395fde9398f10e2d22892c71ebf0
SHA1a2462293369bd887d9bf92c26263473e2e77cffe
SHA256397df290b6068bbf7ba86c08a102c037bcf4294dcd65c8b45f8600a8af032e09
SHA5125d9307682ed2d5ccf77f4d5d12deca987b46e205abb6bd220074536b726a12e8ba04f547d40a95dcf65d2a88237f460e5738625d933426d06dd6e4e212b6b25c
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
a602395fde9398f10e2d22892c71ebf0
SHA1a2462293369bd887d9bf92c26263473e2e77cffe
SHA256397df290b6068bbf7ba86c08a102c037bcf4294dcd65c8b45f8600a8af032e09
SHA5125d9307682ed2d5ccf77f4d5d12deca987b46e205abb6bd220074536b726a12e8ba04f547d40a95dcf65d2a88237f460e5738625d933426d06dd6e4e212b6b25c
-
\Users\Admin\AppData\Roaming\test\test.exeMD5
a602395fde9398f10e2d22892c71ebf0
SHA1a2462293369bd887d9bf92c26263473e2e77cffe
SHA256397df290b6068bbf7ba86c08a102c037bcf4294dcd65c8b45f8600a8af032e09
SHA5125d9307682ed2d5ccf77f4d5d12deca987b46e205abb6bd220074536b726a12e8ba04f547d40a95dcf65d2a88237f460e5738625d933426d06dd6e4e212b6b25c
-
memory/320-90-0x0000000000000000-mapping.dmp
-
memory/328-107-0x00000000004085D0-mapping.dmp
-
memory/728-82-0x0000000000000000-mapping.dmp
-
memory/864-111-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/864-121-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/864-122-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/864-114-0x00000000004B5640-mapping.dmp
-
memory/1084-66-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1084-68-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1084-76-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1084-73-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1084-78-0x0000000000550000-0x0000000000551000-memory.dmpFilesize
4KB
-
memory/1084-77-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1084-62-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1084-72-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/1084-69-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1084-59-0x0000000000400000-0x000000000054B000-memory.dmpFilesize
1.3MB
-
memory/1084-67-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1084-75-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1084-65-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1084-63-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1176-84-0x0000000000000000-mapping.dmp
-
memory/1908-70-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1908-81-0x00000000752F1000-0x00000000752F3000-memory.dmpFilesize
8KB
-
memory/1908-71-0x00000000004085D0-mapping.dmp
-
memory/1908-74-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB