656a20e4d32cb66812ef2230416b3f3ee94ebcc37eb0d6111ce40116618a3cc7

Analysis

max time kernel
107s
max time network
135s
platform
windows10_x64
resource
win10v20210408
submitted
11/06/2021, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0900988099900000.exe
Size 573KB
Sample210611-1f86c8jbln
SHA256 656a20e4d32cb66812ef2230416b3f3ee94ebcc37eb0d6111ce40116618a3cc7
MD5 4071ee7470f09041ebf194caf000a6ba
SHA1 e6f82f0ed134772e90b6daf9eb25aff8d6c9492c
SHA512 5139ca3bcf5b903831d9d6037f4e92bbbec2cb3715b1139720321e875e4634220bd5a473faaf661781767ca5624755fc97a0bf7d6f2cc0d15192054600d69487
MD5 SHA1 SHA512

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
804	0900988099900000.exe
804	0900988099900000.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwwywckmi = "C:\\Users\\Admin\\AppData\\Roaming\\dqufa\\bpym.exe"	0900988099900000.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	freegeoip.app
12	checkip.dyndns.org
15	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 804 set thread context of 3660	804	0900988099900000.exe	75

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
804	0900988099900000.exe
804	0900988099900000.exe
804	0900988099900000.exe
804	0900988099900000.exe
804	0900988099900000.exe
804	0900988099900000.exe
804	0900988099900000.exe
804	0900988099900000.exe
3660	MSBuild.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
804	0900988099900000.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3660	MSBuild.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 3660	804	0900988099900000.exe	75
PID 804 wrote to memory of 3660	804	0900988099900000.exe	75
PID 804 wrote to memory of 3660	804	0900988099900000.exe	75
PID 804 wrote to memory of 3660	804	0900988099900000.exe	75

C:\Users\Admin\AppData\Local\Temp\0900988099900000.exe
"C:\Users\Admin\AppData\Local\Temp\0900988099900000.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\0900988099900000.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3660-117-0x0000000003050000-0x0000000003051000-memory.dmp

Download