Analysis
- max time kernel
66s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
01/08/2021, 16:37
Static task
static1
Behavioral task
behavioral1
Sample
02ab49305f95f010772aba55ea61744e.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
02ab49305f95f010772aba55ea61744e.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 02ab49305f95f010772aba55ea61744e.exe
- Size 7KB
- Sample210801-2bc9er6th6
- SHA256 7e6b769afc67e5e76904920f69a8d31475576ee4dc3411379efa665de38f7697
- MD5 02ab49305f95f010772aba55ea61744e
- SHA1 21d8aed31b7a2ccd2254a21c940a545693ca5835
- SHA512 adf6c3c2de61923c93216ede72dd97a337a5fb0dc78a450a2812bb7d743e10cd140f855898a447c43fe5b0148c02af0c868b117c7da7151da30d87fa641d587d
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
pid Process 3264 Zhfahjg.exe 644 Picture.exe 200 Zhfahjg.exe 728 Zhfahjg.exe -
resource yara_rule behavioral2/files/0x00040000000155fd-115.dat upx behavioral2/files/0x00040000000155fd-116.dat upx behavioral2/memory/992-118-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/files/0x00040000000155fd-122.dat upx behavioral2/memory/200-124-0x0000000010000000-0x000000001034B000-memory.dmp upx behavioral2/files/0x00040000000155fd-126.dat upx - Deletes itself 1 IoCs
pid Process 728 Zhfahjg.exe - Loads dropped DLL 1 IoCs
pid Process 644 Picture.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Zhfahjg.exe File opened (read-only) \??\J: Zhfahjg.exe File opened (read-only) \??\N: Zhfahjg.exe File opened (read-only) \??\P: Zhfahjg.exe File opened (read-only) \??\T: Zhfahjg.exe File opened (read-only) \??\U: Zhfahjg.exe File opened (read-only) \??\E: Zhfahjg.exe File opened (read-only) \??\F: Zhfahjg.exe File opened (read-only) \??\H: Zhfahjg.exe File opened (read-only) \??\S: Zhfahjg.exe File opened (read-only) \??\V: Zhfahjg.exe File opened (read-only) \??\W: Zhfahjg.exe File opened (read-only) \??\Y: Zhfahjg.exe File opened (read-only) \??\B: Zhfahjg.exe File opened (read-only) \??\G: Zhfahjg.exe File opened (read-only) \??\O: Zhfahjg.exe File opened (read-only) \??\Q: Zhfahjg.exe File opened (read-only) \??\R: Zhfahjg.exe File opened (read-only) \??\L: Zhfahjg.exe File opened (read-only) \??\M: Zhfahjg.exe File opened (read-only) \??\Z: Zhfahjg.exe File opened (read-only) \??\K: Zhfahjg.exe File opened (read-only) \??\X: Zhfahjg.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\259300750.txt Picture.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\AppPatch\NetSyst96.dll 02ab49305f95f010772aba55ea61744e.exe File created C:\Program Files (x86)\Microsoft Wapjna\Zhfahjg.exe 02ab49305f95f010772aba55ea61744e.exe File opened for modification C:\Program Files (x86)\Microsoft Wapjna\Zhfahjg.exe 02ab49305f95f010772aba55ea61744e.exe File created C:\Program Files\AppPatch\NetSyst96.dll 02ab49305f95f010772aba55ea61744e.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 1532 644 WerFault.exe 76 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Zhfahjg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Zhfahjg.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Zhfahjg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Zhfahjg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Zhfahjg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Zhfahjg.exe Key created \REGISTRY\USER\.DEFAULT\Software Zhfahjg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe 728 Zhfahjg.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 992 02ab49305f95f010772aba55ea61744e.exe Token: SeDebugPrivilege 3264 Zhfahjg.exe Token: SeDebugPrivilege 200 Zhfahjg.exe Token: SeRestorePrivilege 1532 WerFault.exe Token: SeBackupPrivilege 1532 WerFault.exe Token: SeDebugPrivilege 200 Zhfahjg.exe Token: SeDebugPrivilege 728 Zhfahjg.exe Token: SeDebugPrivilege 1532 WerFault.exe Token: SeDebugPrivilege 728 Zhfahjg.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 992 wrote to memory of 3264 992 02ab49305f95f010772aba55ea61744e.exe 75 PID 992 wrote to memory of 3264 992 02ab49305f95f010772aba55ea61744e.exe 75 PID 992 wrote to memory of 3264 992 02ab49305f95f010772aba55ea61744e.exe 75 PID 3264 wrote to memory of 644 3264 Zhfahjg.exe 76 PID 3264 wrote to memory of 644 3264 Zhfahjg.exe 76 PID 3264 wrote to memory of 644 3264 Zhfahjg.exe 76 PID 200 wrote to memory of 728 200 Zhfahjg.exe 80 PID 200 wrote to memory of 728 200 Zhfahjg.exe 80 PID 200 wrote to memory of 728 200 Zhfahjg.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\02ab49305f95f010772aba55ea61744e.exe"C:\Users\Admin\AppData\Local\Temp\02ab49305f95f010772aba55ea61744e.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Program Files (x86)\Microsoft Wapjna\Zhfahjg.exe"C:\Program Files (x86)\Microsoft Wapjna\Zhfahjg.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Picture.exe"C:\Picture.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 5284⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
-
-
C:\Program Files (x86)\Microsoft Wapjna\Zhfahjg.exe"C:\Program Files (x86)\Microsoft Wapjna\Zhfahjg.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Program Files (x86)\Microsoft Wapjna\Zhfahjg.exe"C:\Program Files (x86)\Microsoft Wapjna\Zhfahjg.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:728
-