Resubmissions
26/07/2022, 07:12
220726-h1ld8sehcq1024/02/2022, 11:15
220224-nczjvachd8802/08/2021, 09:23
210802-dz94clans68Analysis
- max time kernel
149s - max time network
186s - platform
windows7_x64 - resource
win7v20210408 - submitted
02/08/2021, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
- Size 497KB
- Sample210802-dz94clans6
- SHA256 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
- MD5 23595373d96bdbaf4a1361971aa96539
- SHA1 020b0f179386a5ceee09e042ed7818ee42b2eba8
- SHA512 7e19addfec1ed3aa921f79c45a342e1ad5aa5db0483a2b9e54396335396e9c92545d8e49b4520ce562d1b786741bfceb940327acddbb020da87e93708bc5a783
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1848 mcinsupd.exe 1036 mcinsupd.exe - Loads dropped DLL 6 IoCs
pid Process 2004 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 2004 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 2004 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 2004 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 1848 mcinsupd.exe 1036 mcinsupd.exe - Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\McAfee VirusScan\mytilus3.dll mcinsupd.exe File created C:\Program Files (x86)\McAfee VirusScan\mytilus3.dll mcinsupd.exe File opened for modification C:\Program Files (x86)\McAfee VirusScan\mytilus3.dat mcinsupd.exe File created C:\Program Files (x86)\McAfee VirusScan\mytilus3.dat mcinsupd.exe File opened for modification C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe mcinsupd.exe File created C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe mcinsupd.exe File opened for modification C:\Program Files (x86)\McAfee VirusScan mcinsupd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\aa-42-f0-13-0a-82 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecision = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 20a852819087d701 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = e0fca3939087d701 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = c0677e6e9087d701 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 807a73a69087d701 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionReason = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDetectedUrl svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = 20a852819087d701 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = e0fca3939087d701 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = 807a73a69087d701 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-42-f0-13-0a-82\WpadDecisionTime = c0677e6e9087d701 svchost.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\KET.FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 34004500340041004100380042003100360037003800410036003400310041000000 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 1308 svchost.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 1308 svchost.exe 1308 svchost.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 1308 svchost.exe 1308 svchost.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 1308 svchost.exe 1308 svchost.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 1308 svchost.exe 1308 svchost.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 1308 svchost.exe 1308 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1308 svchost.exe 916 rundll32.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1848 mcinsupd.exe Token: SeTcbPrivilege 1848 mcinsupd.exe Token: SeDebugPrivilege 1036 mcinsupd.exe Token: SeTcbPrivilege 1036 mcinsupd.exe Token: SeDebugPrivilege 1308 svchost.exe Token: SeTcbPrivilege 1308 svchost.exe Token: SeDebugPrivilege 916 rundll32.exe Token: SeTcbPrivilege 916 rundll32.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1848 2004 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 29 PID 2004 wrote to memory of 1848 2004 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 29 PID 2004 wrote to memory of 1848 2004 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 29 PID 2004 wrote to memory of 1848 2004 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 29 PID 2004 wrote to memory of 1848 2004 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 29 PID 2004 wrote to memory of 1848 2004 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 29 PID 2004 wrote to memory of 1848 2004 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 29 PID 1036 wrote to memory of 1308 1036 mcinsupd.exe 31 PID 1036 wrote to memory of 1308 1036 mcinsupd.exe 31 PID 1036 wrote to memory of 1308 1036 mcinsupd.exe 31 PID 1036 wrote to memory of 1308 1036 mcinsupd.exe 31 PID 1036 wrote to memory of 1308 1036 mcinsupd.exe 31 PID 1036 wrote to memory of 1308 1036 mcinsupd.exe 31 PID 1036 wrote to memory of 1308 1036 mcinsupd.exe 31 PID 1036 wrote to memory of 1308 1036 mcinsupd.exe 31 PID 1036 wrote to memory of 1308 1036 mcinsupd.exe 31 PID 1308 wrote to memory of 916 1308 svchost.exe 33 PID 1308 wrote to memory of 916 1308 svchost.exe 33 PID 1308 wrote to memory of 916 1308 svchost.exe 33 PID 1308 wrote to memory of 916 1308 svchost.exe 33 PID 1308 wrote to memory of 916 1308 svchost.exe 33 PID 1308 wrote to memory of 916 1308 svchost.exe 33 PID 1308 wrote to memory of 916 1308 svchost.exe 33 PID 1308 wrote to memory of 916 1308 svchost.exe 33 PID 1308 wrote to memory of 916 1308 svchost.exe 33 PID 1308 wrote to memory of 916 1308 svchost.exe 33 PID 1308 wrote to memory of 916 1308 svchost.exe 33 PID 1308 wrote to memory of 916 1308 svchost.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe"C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe" 600 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 601 02⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe 609 13083⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:916
-
-