Analysis
-
max time kernel
110s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 12:59
Static task
static1
Behavioral task
behavioral1
Sample
58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exe
Resource
win10v20210410
General
-
Target
58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exe
-
Size
94KB
-
MD5
73de5babf166f28dc81d6c2faa369379
-
SHA1
e393a9ecf0d0a8babaa5efcc34f10577aff1cad1
-
SHA256
58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c
-
SHA512
d1a473ce9af849820b8cc9d777478e2a69293f3471ee3120f9ca96c43af922e0d661048d2d36688a62a63aa185728f83ee32f5a67ddcc0d1633c5bfe46c5ea51
Malware Config
Extracted
C:\1DC4F-Readme.txt
netwalker
kkeessnnkkaa@cock.li
hhaaxxhhaaxx@tuta.io
Extracted
C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\1DC4F-Readme.txt
netwalker
kkeessnnkkaa@cock.li
hhaaxxhhaaxx@tuta.io
Signatures
-
Detected Netwalker Ransomware 2 IoCs
Detected unpacked Netwalker executable.
Processes:
resource yara_rule behavioral1/memory/1192-67-0x0000000000080000-0x000000000009B000-memory.dmp netwalker_ransomware behavioral1/memory/2036-68-0x00000000000C0000-0x00000000000DB000-memory.dmp netwalker_ransomware -
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
explorer.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\MeasureUpdate.tiff explorer.exe File opened for modification C:\Users\Admin\Pictures\ExportReceive.tiff explorer.exe File opened for modification C:\Users\Admin\Pictures\UndoRead.tiff explorer.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 1192 explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1dc4fa2f = "C:\\Program Files (x86)\\1dc4fa2f\\1dc4fa2f.exe" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exeexplorer.exedescription pid process target process PID 308 set thread context of 1192 308 58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exe explorer.exe PID 1192 set thread context of 2036 1192 explorer.exe explorer.exe -
Drops file in Program Files directory 64 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jni.h explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALSO11.POC explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02754U.BMP explorer.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\1DC4F-Readme.txt explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR4B.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0291794.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WHIRL1.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\GRIP.JPG explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151061.WMF explorer.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\1DC4F-Readme.txt explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\HEADER.GIF explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88 explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BRCHUR98.POC explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Discussion.css explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107526.WMF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2F.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14513_.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR32F.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02039U.BMP explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.PL.XML explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157177.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBBTN.DPV explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.HTM explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0089992.WMF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21398_.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME01.CSS explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCARD.DPV explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00017_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212219.WMF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OMSINTL.DLL.IDX_DLL explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar explorer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\1DC4F-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Projects.accdt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\WARN.WAV explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18190_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Response.css explorer.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\1DC4F-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBSBR.XML explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chicago explorer.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\1DC4F-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR23F.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18217_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLOGO.XML explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\TAB_ON.GIF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21332_.GIF explorer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\1DC4F-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Opulent.xml explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tasks.accdt explorer.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1976 vssadmin.exe 1216 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
explorer.exeexplorer.exepid process 1192 explorer.exe 1192 explorer.exe 1192 explorer.exe 1192 explorer.exe 1192 explorer.exe 1192 explorer.exe 1192 explorer.exe 1192 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exeexplorer.exepid process 308 58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exe 1192 explorer.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
explorer.exevssvc.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2036 explorer.exe Token: SeBackupPrivilege 1756 vssvc.exe Token: SeRestorePrivilege 1756 vssvc.exe Token: SeAuditPrivilege 1756 vssvc.exe Token: SeDebugPrivilege 1192 explorer.exe Token: SeImpersonatePrivilege 1192 explorer.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exeexplorer.exeexplorer.exedescription pid process target process PID 308 wrote to memory of 1192 308 58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exe explorer.exe PID 308 wrote to memory of 1192 308 58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exe explorer.exe PID 308 wrote to memory of 1192 308 58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exe explorer.exe PID 308 wrote to memory of 1192 308 58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exe explorer.exe PID 1192 wrote to memory of 2036 1192 explorer.exe explorer.exe PID 1192 wrote to memory of 2036 1192 explorer.exe explorer.exe PID 1192 wrote to memory of 2036 1192 explorer.exe explorer.exe PID 1192 wrote to memory of 2036 1192 explorer.exe explorer.exe PID 2036 wrote to memory of 1976 2036 explorer.exe vssadmin.exe PID 2036 wrote to memory of 1976 2036 explorer.exe vssadmin.exe PID 2036 wrote to memory of 1976 2036 explorer.exe vssadmin.exe PID 2036 wrote to memory of 1976 2036 explorer.exe vssadmin.exe PID 1192 wrote to memory of 212 1192 explorer.exe notepad.exe PID 1192 wrote to memory of 212 1192 explorer.exe notepad.exe PID 1192 wrote to memory of 212 1192 explorer.exe notepad.exe PID 1192 wrote to memory of 212 1192 explorer.exe notepad.exe PID 1192 wrote to memory of 1216 1192 explorer.exe vssadmin.exe PID 1192 wrote to memory of 1216 1192 explorer.exe vssadmin.exe PID 1192 wrote to memory of 1216 1192 explorer.exe vssadmin.exe PID 1192 wrote to memory of 1216 1192 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exe"C:\Users\Admin\AppData\Local\Temp\58e923ff158fb5aecd293b7a0e0d305296110b83c6e270786edcc4fea1c8404c.sample.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"2⤵
- Modifies extensions of user files
- Deletes itself
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\1DC4F-Readme.txt"3⤵
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\1DC4F-Readme.txtMD5
0cc3b4b3aa17aef6f905acde0b4752ad
SHA1474b2f8f8ca456451420a4eae2e7e3f798afc4fa
SHA256366ab5680d2db5d72dbd8587fa56d8b743629fb4b43ddbe5a1188dfe9d22a567
SHA5124be55be6b6dd260f41017b2928ad382aa8fa2fe9ed47e500bebf5d5ec9e00ce685898e26cd96b3a4c5d9b872ffe7c21331c55e3edf75a0ac215de2a7a7b281d7
-
memory/212-70-0x0000000000000000-mapping.dmp
-
memory/308-60-0x0000000075A31000-0x0000000075A33000-memory.dmpFilesize
8KB
-
memory/1192-61-0x0000000000000000-mapping.dmp
-
memory/1192-63-0x0000000075411000-0x0000000075413000-memory.dmpFilesize
8KB
-
memory/1192-67-0x0000000000080000-0x000000000009B000-memory.dmpFilesize
108KB
-
memory/1216-72-0x0000000000000000-mapping.dmp
-
memory/1976-69-0x0000000000000000-mapping.dmp
-
memory/2036-64-0x0000000000000000-mapping.dmp
-
memory/2036-68-0x00000000000C0000-0x00000000000DB000-memory.dmpFilesize
108KB