703cb19c4f58a9043fc687cc2a851640d6f79ff7e8afafdc41dfcb3c896df017

Analysis

max time kernel
144s
max time network
146s
platform
windows10_x64
resource
win10v20210410
submitted
24/05/2021, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
751798eb_by_Libranalysis.exe
Size 1.5MB
Sample210524-egcedxc8qs
SHA256 703cb19c4f58a9043fc687cc2a851640d6f79ff7e8afafdc41dfcb3c896df017
MD5 751798eb2b9f14d827c94d49e2764098
SHA1 e7f758090c7af782e5b6e64d2db16fd88f41e933
SHA512 08f450775440e546fe7ca4cee6d09fa37e3b0910c7f743c7bb39e3eec8e7f07f5e7ba20236c7509d264646adfe8d4738ba2bcffa7f8d43605cc016bf7b5bffc1
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2348 created 3580	2348	WerFault.exe	90

Executes dropped EXE 5 IoCs

pid	Process
1912	vpn.exe
2116	4.exe
932	Finita.exe.com
3384	Finita.exe.com
3892	SmartClock.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	4.exe

Loads dropped DLL 1 IoCs

pid	Process
3944	751798eb_by_Libranalysis.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3384 set thread context of 3580	3384	Finita.exe.com	90

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\foler\olader\acppage.dll	751798eb_by_Libranalysis.exe
File created	C:\Program Files (x86)\foler\olader\adprovider.dll	751798eb_by_Libranalysis.exe
File created	C:\Program Files (x86)\foler\olader\acledit.dll	751798eb_by_Libranalysis.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	3580	WerFault.exe	90

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4072	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3892	SmartClock.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe
2348	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2348	WerFault.exe
Token: SeBackupPrivilege	2348	WerFault.exe
Token: SeDebugPrivilege	2348	WerFault.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1912	vpn.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 1912	3944	751798eb_by_Libranalysis.exe	74
PID 3944 wrote to memory of 1912	3944	751798eb_by_Libranalysis.exe	74
PID 3944 wrote to memory of 1912	3944	751798eb_by_Libranalysis.exe	74
PID 3944 wrote to memory of 2116	3944	751798eb_by_Libranalysis.exe	75
PID 3944 wrote to memory of 2116	3944	751798eb_by_Libranalysis.exe	75
PID 3944 wrote to memory of 2116	3944	751798eb_by_Libranalysis.exe	75
PID 1912 wrote to memory of 2944	1912	vpn.exe	77
PID 1912 wrote to memory of 2944	1912	vpn.exe	77
PID 1912 wrote to memory of 2944	1912	vpn.exe	77
PID 2944 wrote to memory of 3484	2944	cmd.exe	79
PID 2944 wrote to memory of 3484	2944	cmd.exe	79
PID 2944 wrote to memory of 3484	2944	cmd.exe	79
PID 3484 wrote to memory of 3248	3484	cmd.exe	81
PID 3484 wrote to memory of 3248	3484	cmd.exe	81
PID 3484 wrote to memory of 3248	3484	cmd.exe	81
PID 3484 wrote to memory of 932	3484	cmd.exe	82
PID 3484 wrote to memory of 932	3484	cmd.exe	82
PID 3484 wrote to memory of 932	3484	cmd.exe	82
PID 3484 wrote to memory of 4072	3484	cmd.exe	83
PID 3484 wrote to memory of 4072	3484	cmd.exe	83
PID 3484 wrote to memory of 4072	3484	cmd.exe	83
PID 932 wrote to memory of 3384	932	Finita.exe.com	84
PID 932 wrote to memory of 3384	932	Finita.exe.com	84
PID 932 wrote to memory of 3384	932	Finita.exe.com	84
PID 2116 wrote to memory of 3892	2116	4.exe	87
PID 2116 wrote to memory of 3892	2116	4.exe	87
PID 2116 wrote to memory of 3892	2116	4.exe	87
PID 3384 wrote to memory of 3580	3384	Finita.exe.com	90
PID 3384 wrote to memory of 3580	3384	Finita.exe.com	90
PID 3384 wrote to memory of 3580	3384	Finita.exe.com	90
PID 3384 wrote to memory of 3580	3384	Finita.exe.com	90
PID 3384 wrote to memory of 3580	3384	Finita.exe.com	90

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3580	attrib.exe

C:\Users\Admin\AppData\Local\Temp\751798eb_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\751798eb_by_Libranalysis.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
  "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Mani.tiff
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3484
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^evPBaEfWQqyNKZLtKkIKaOhysWAewfstsPVxTRBcMnTIddqdSDRELSGhpKpvtjVBJqvVrskTKhYTVEPwWppbbMznoHloItdmDsYfTtjBaYUnUMsEUimVrbrWHYMvuelFWndEGmiRXHtmSVDvfFhA$" Tramonto.tiff
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Finita.exe.com
        
        Finita.exe.com c
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Finita.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Finita.exe.com c
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\attrib.exe
        
        C:\Windows\SysWOW64\attrib.exe
        7⤵
        Views/modifies file attributes
        
        PID:3580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 180
        8⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 30
        5⤵
        Runs ping.exe
        
        PID:4072
- C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
  "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
    "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    PID:3892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-135-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2116-134-0x0000000000570000-0x00000000006BA000-memory.dmp

Download

memory/3384-141-0x0000000000F00000-0x000000000104A000-memory.dmp

Download

memory/3580-142-0x0000000000840000-0x0000000000867000-memory.dmp

Download

memory/3892-139-0x00000000004E0000-0x000000000058E000-memory.dmp

Download

memory/3892-140-0x0000000000400000-0x000000000045E000-memory.dmp

Download