Resubmissions
26/07/2022, 07:12
220726-h1ld8sehcq1024/02/2022, 11:15
220224-nczjvachd8802/08/2021, 09:23
210802-dz94clans68Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20210410 - submitted
02/08/2021, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
- Size 497KB
- Sample210802-dz94clans6
- SHA256 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
- MD5 23595373d96bdbaf4a1361971aa96539
- SHA1 020b0f179386a5ceee09e042ed7818ee42b2eba8
- SHA512 7e19addfec1ed3aa921f79c45a342e1ad5aa5db0483a2b9e54396335396e9c92545d8e49b4520ce562d1b786741bfceb940327acddbb020da87e93708bc5a783
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3564 mcinsupd.exe 208 mcinsupd.exe - Loads dropped DLL 2 IoCs
pid Process 3564 mcinsupd.exe 208 mcinsupd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run mcinsupd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\McAfee VirusScan API Daily Update Module = "\"C:\\Users\\Admin\\McAfee VirusScan API Daily Update Module\\mcinsupd.exe\" 600 0" mcinsupd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\KET.FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 38003800360030003700330036003100330037003100330045004600360043000000 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4076 svchost.exe 4076 svchost.exe 4076 svchost.exe 4076 svchost.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 4076 svchost.exe 4076 svchost.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 4076 svchost.exe 4076 svchost.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 4076 svchost.exe 4076 svchost.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 4076 svchost.exe 4076 svchost.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 4076 svchost.exe 4076 svchost.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe 744 rundll32.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4076 svchost.exe 744 rundll32.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3564 mcinsupd.exe Token: SeTcbPrivilege 3564 mcinsupd.exe Token: SeDebugPrivilege 208 mcinsupd.exe Token: SeTcbPrivilege 208 mcinsupd.exe Token: SeDebugPrivilege 4076 svchost.exe Token: SeTcbPrivilege 4076 svchost.exe Token: SeDebugPrivilege 744 rundll32.exe Token: SeTcbPrivilege 744 rundll32.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3908 wrote to memory of 3564 3908 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 75 PID 3908 wrote to memory of 3564 3908 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 75 PID 3908 wrote to memory of 3564 3908 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 75 PID 3564 wrote to memory of 208 3564 mcinsupd.exe 77 PID 3564 wrote to memory of 208 3564 mcinsupd.exe 77 PID 3564 wrote to memory of 208 3564 mcinsupd.exe 77 PID 208 wrote to memory of 4076 208 mcinsupd.exe 79 PID 208 wrote to memory of 4076 208 mcinsupd.exe 79 PID 208 wrote to memory of 4076 208 mcinsupd.exe 79 PID 208 wrote to memory of 4076 208 mcinsupd.exe 79 PID 208 wrote to memory of 4076 208 mcinsupd.exe 79 PID 208 wrote to memory of 4076 208 mcinsupd.exe 79 PID 208 wrote to memory of 4076 208 mcinsupd.exe 79 PID 208 wrote to memory of 4076 208 mcinsupd.exe 79 PID 4076 wrote to memory of 744 4076 svchost.exe 82 PID 4076 wrote to memory of 744 4076 svchost.exe 82 PID 4076 wrote to memory of 744 4076 svchost.exe 82 PID 4076 wrote to memory of 744 4076 svchost.exe 82 PID 4076 wrote to memory of 744 4076 svchost.exe 82 PID 4076 wrote to memory of 744 4076 svchost.exe 82 PID 4076 wrote to memory of 744 4076 svchost.exe 82 PID 4076 wrote to memory of 744 4076 svchost.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe"C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe" 600 03⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 601 04⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe 609 40765⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:744
-
-
-
-