Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-07-2021 12:30
Static task
static1
Behavioral task
behavioral1
Sample
1375950da71f03040d4043d9d84ac4c9.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1375950da71f03040d4043d9d84ac4c9.exe
Resource
win10v20210408
General
-
Target
1375950da71f03040d4043d9d84ac4c9.exe
-
Size
2.6MB
-
MD5
1375950da71f03040d4043d9d84ac4c9
-
SHA1
5f4baed37f6eb23d1b6efbe58ece75030f701a77
-
SHA256
635764197d1aff622d35d6b6c44a72c8a09b60a55ca465cef868ba428b30b164
-
SHA512
900a66f69a6392e5e73fc52b5ecd5a50559256c8e55dbdeb8ad5634a41774a9745cd07bdcf12ad4c77c39107748fe3ed11c4b27d2c0b518448949ed4e1606ce6
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Word.exeWord.exepid process 3716 Word.exe 2692 Word.exe -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/996-122-0x0000000006EC0000-0x0000000006EE1000-memory.dmp agile_net behavioral2/memory/3716-142-0x0000000004FD0000-0x00000000054CE000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\word = "C:\\Users\\Admin\\Videos\\Word.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Word.exedescription pid process target process PID 3716 set thread context of 2692 3716 Word.exe Word.exe -
autoit_exe 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2692-146-0x0000000000426BF7-mapping.dmp autoit_exe behavioral2/memory/2692-148-0x00000000007C0000-0x0000000000906000-memory.dmp autoit_exe behavioral2/memory/2692-152-0x00000000007C0000-0x0000000000906000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2600 2692 WerFault.exe Word.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
1375950da71f03040d4043d9d84ac4c9.exeWord.exeWerFault.exepid process 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 996 1375950da71f03040d4043d9d84ac4c9.exe 3716 Word.exe 3716 Word.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
1375950da71f03040d4043d9d84ac4c9.exeWord.exeWerFault.exedescription pid process Token: SeDebugPrivilege 996 1375950da71f03040d4043d9d84ac4c9.exe Token: SeDebugPrivilege 3716 Word.exe Token: SeRestorePrivilege 2600 WerFault.exe Token: SeBackupPrivilege 2600 WerFault.exe Token: SeDebugPrivilege 2600 WerFault.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
1375950da71f03040d4043d9d84ac4c9.execmd.exeWord.exedescription pid process target process PID 996 wrote to memory of 2700 996 1375950da71f03040d4043d9d84ac4c9.exe cmd.exe PID 996 wrote to memory of 2700 996 1375950da71f03040d4043d9d84ac4c9.exe cmd.exe PID 996 wrote to memory of 2700 996 1375950da71f03040d4043d9d84ac4c9.exe cmd.exe PID 2700 wrote to memory of 2976 2700 cmd.exe reg.exe PID 2700 wrote to memory of 2976 2700 cmd.exe reg.exe PID 2700 wrote to memory of 2976 2700 cmd.exe reg.exe PID 996 wrote to memory of 3716 996 1375950da71f03040d4043d9d84ac4c9.exe Word.exe PID 996 wrote to memory of 3716 996 1375950da71f03040d4043d9d84ac4c9.exe Word.exe PID 996 wrote to memory of 3716 996 1375950da71f03040d4043d9d84ac4c9.exe Word.exe PID 3716 wrote to memory of 2692 3716 Word.exe Word.exe PID 3716 wrote to memory of 2692 3716 Word.exe Word.exe PID 3716 wrote to memory of 2692 3716 Word.exe Word.exe PID 3716 wrote to memory of 2692 3716 Word.exe Word.exe PID 3716 wrote to memory of 2692 3716 Word.exe Word.exe PID 3716 wrote to memory of 2692 3716 Word.exe Word.exe PID 3716 wrote to memory of 2692 3716 Word.exe Word.exe PID 3716 wrote to memory of 2692 3716 Word.exe Word.exe PID 3716 wrote to memory of 2692 3716 Word.exe Word.exe PID 3716 wrote to memory of 2692 3716 Word.exe Word.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1375950da71f03040d4043d9d84ac4c9.exe"C:\Users\Admin\AppData\Local\Temp\1375950da71f03040d4043d9d84ac4c9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\Videos\Word.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "word" /t REG_SZ /d "C:\Users\Admin\Videos\Word.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\Videos\Word.exe"C:\Users\Admin\Videos\Word.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Videos\Word.exe"C:\Users\Admin\Videos\Word.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 5804⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Videos\Word.exeMD5
1375950da71f03040d4043d9d84ac4c9
SHA15f4baed37f6eb23d1b6efbe58ece75030f701a77
SHA256635764197d1aff622d35d6b6c44a72c8a09b60a55ca465cef868ba428b30b164
SHA512900a66f69a6392e5e73fc52b5ecd5a50559256c8e55dbdeb8ad5634a41774a9745cd07bdcf12ad4c77c39107748fe3ed11c4b27d2c0b518448949ed4e1606ce6
-
C:\Users\Admin\Videos\Word.exeMD5
1375950da71f03040d4043d9d84ac4c9
SHA15f4baed37f6eb23d1b6efbe58ece75030f701a77
SHA256635764197d1aff622d35d6b6c44a72c8a09b60a55ca465cef868ba428b30b164
SHA512900a66f69a6392e5e73fc52b5ecd5a50559256c8e55dbdeb8ad5634a41774a9745cd07bdcf12ad4c77c39107748fe3ed11c4b27d2c0b518448949ed4e1606ce6
-
C:\Users\Admin\Videos\Word.exeMD5
1375950da71f03040d4043d9d84ac4c9
SHA15f4baed37f6eb23d1b6efbe58ece75030f701a77
SHA256635764197d1aff622d35d6b6c44a72c8a09b60a55ca465cef868ba428b30b164
SHA512900a66f69a6392e5e73fc52b5ecd5a50559256c8e55dbdeb8ad5634a41774a9745cd07bdcf12ad4c77c39107748fe3ed11c4b27d2c0b518448949ed4e1606ce6
-
memory/996-124-0x0000000006F50000-0x0000000006F51000-memory.dmpFilesize
4KB
-
memory/996-119-0x0000000005B80000-0x0000000005B81000-memory.dmpFilesize
4KB
-
memory/996-120-0x0000000005660000-0x00000000056F2000-memory.dmpFilesize
584KB
-
memory/996-122-0x0000000006EC0000-0x0000000006EE1000-memory.dmpFilesize
132KB
-
memory/996-123-0x0000000006F90000-0x0000000006F91000-memory.dmpFilesize
4KB
-
memory/996-125-0x0000000005660000-0x00000000056F2000-memory.dmpFilesize
584KB
-
memory/996-114-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/996-118-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/996-117-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/996-116-0x0000000005C90000-0x0000000005C91000-memory.dmpFilesize
4KB
-
memory/2692-146-0x0000000000426BF7-mapping.dmp
-
memory/2692-152-0x00000000007C0000-0x0000000000906000-memory.dmpFilesize
1.3MB
-
memory/2692-148-0x00000000007C0000-0x0000000000906000-memory.dmpFilesize
1.3MB
-
memory/2700-126-0x0000000000000000-mapping.dmp
-
memory/2976-127-0x0000000000000000-mapping.dmp
-
memory/3716-143-0x0000000007B00000-0x0000000007B0B000-memory.dmpFilesize
44KB
-
memory/3716-144-0x0000000002900000-0x0000000002901000-memory.dmpFilesize
4KB
-
memory/3716-142-0x0000000004FD0000-0x00000000054CE000-memory.dmpFilesize
5.0MB
-
memory/3716-138-0x0000000004FD0000-0x00000000054CE000-memory.dmpFilesize
5.0MB
-
memory/3716-128-0x0000000000000000-mapping.dmp