Analysis
-
max time kernel
160s -
max time network
197s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
31-08-2021 06:53
Static task
static1
Behavioral task
behavioral1
Sample
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe
Resource
win7v20210408
General
-
Target
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe
-
Size
318KB
-
MD5
a49f8963a4c3949b06e4301caa2de435
-
SHA1
2784038e702ea56c70b56d0ba2dab6dac5512746
-
SHA256
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
-
SHA512
f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 1852 updater.exe -
Processes:
resource yara_rule \ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe upx C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe upx C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe upx \ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe upx \ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe upx \ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 688 notepad.exe -
Loads dropped DLL 4 IoCs
Processes:
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exeupdater.exepid process 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe 1852 updater.exe 1852 updater.exe 1852 updater.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exeupdater.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" updater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exeupdater.exedescription pid process Token: SeIncreaseQuotaPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeSecurityPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeTakeOwnershipPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeLoadDriverPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeSystemProfilePrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeSystemtimePrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeProfSingleProcessPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeIncBasePriorityPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeCreatePagefilePrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeBackupPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeRestorePrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeShutdownPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeDebugPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeSystemEnvironmentPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeChangeNotifyPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeRemoteShutdownPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeUndockPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeManageVolumePrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeImpersonatePrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeCreateGlobalPrivilege 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: 33 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: 34 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: 35 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeIncreaseQuotaPrivilege 1852 updater.exe Token: SeSecurityPrivilege 1852 updater.exe Token: SeTakeOwnershipPrivilege 1852 updater.exe Token: SeLoadDriverPrivilege 1852 updater.exe Token: SeSystemProfilePrivilege 1852 updater.exe Token: SeSystemtimePrivilege 1852 updater.exe Token: SeProfSingleProcessPrivilege 1852 updater.exe Token: SeIncBasePriorityPrivilege 1852 updater.exe Token: SeCreatePagefilePrivilege 1852 updater.exe Token: SeBackupPrivilege 1852 updater.exe Token: SeRestorePrivilege 1852 updater.exe Token: SeShutdownPrivilege 1852 updater.exe Token: SeDebugPrivilege 1852 updater.exe Token: SeSystemEnvironmentPrivilege 1852 updater.exe Token: SeChangeNotifyPrivilege 1852 updater.exe Token: SeRemoteShutdownPrivilege 1852 updater.exe Token: SeUndockPrivilege 1852 updater.exe Token: SeManageVolumePrivilege 1852 updater.exe Token: SeImpersonatePrivilege 1852 updater.exe Token: SeCreateGlobalPrivilege 1852 updater.exe Token: 33 1852 updater.exe Token: 34 1852 updater.exe Token: 35 1852 updater.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
updater.exepid process 1852 updater.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.execmd.execmd.exeupdater.exedescription pid process target process PID 1900 wrote to memory of 1352 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 1900 wrote to memory of 1352 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 1900 wrote to memory of 1352 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 1900 wrote to memory of 1352 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 1900 wrote to memory of 988 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 1900 wrote to memory of 988 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 1900 wrote to memory of 988 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 1900 wrote to memory of 988 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 988 wrote to memory of 1532 988 cmd.exe attrib.exe PID 988 wrote to memory of 1532 988 cmd.exe attrib.exe PID 988 wrote to memory of 1532 988 cmd.exe attrib.exe PID 988 wrote to memory of 1532 988 cmd.exe attrib.exe PID 1352 wrote to memory of 640 1352 cmd.exe attrib.exe PID 1352 wrote to memory of 640 1352 cmd.exe attrib.exe PID 1352 wrote to memory of 640 1352 cmd.exe attrib.exe PID 1352 wrote to memory of 640 1352 cmd.exe attrib.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 688 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 1900 wrote to memory of 1852 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe updater.exe PID 1900 wrote to memory of 1852 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe updater.exe PID 1900 wrote to memory of 1852 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe updater.exe PID 1900 wrote to memory of 1852 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe updater.exe PID 1900 wrote to memory of 1852 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe updater.exe PID 1900 wrote to memory of 1852 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe updater.exe PID 1900 wrote to memory of 1852 1900 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe updater.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe PID 1852 wrote to memory of 1616 1852 updater.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 640 attrib.exe 1532 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe"C:\Users\Admin\AppData\Local\Temp\074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe"C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exeMD5
a49f8963a4c3949b06e4301caa2de435
SHA12784038e702ea56c70b56d0ba2dab6dac5512746
SHA256074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
SHA512f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exeMD5
a49f8963a4c3949b06e4301caa2de435
SHA12784038e702ea56c70b56d0ba2dab6dac5512746
SHA256074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
SHA512f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exeMD5
a49f8963a4c3949b06e4301caa2de435
SHA12784038e702ea56c70b56d0ba2dab6dac5512746
SHA256074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
SHA512f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exeMD5
a49f8963a4c3949b06e4301caa2de435
SHA12784038e702ea56c70b56d0ba2dab6dac5512746
SHA256074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
SHA512f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exeMD5
a49f8963a4c3949b06e4301caa2de435
SHA12784038e702ea56c70b56d0ba2dab6dac5512746
SHA256074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
SHA512f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exeMD5
a49f8963a4c3949b06e4301caa2de435
SHA12784038e702ea56c70b56d0ba2dab6dac5512746
SHA256074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
SHA512f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
memory/640-65-0x0000000000000000-mapping.dmp
-
memory/688-66-0x0000000000000000-mapping.dmp
-
memory/688-78-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/988-63-0x0000000000000000-mapping.dmp
-
memory/1352-62-0x0000000000000000-mapping.dmp
-
memory/1532-64-0x0000000000000000-mapping.dmp
-
memory/1616-76-0x0000000000000000-mapping.dmp
-
memory/1616-80-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1852-69-0x0000000000000000-mapping.dmp
-
memory/1852-79-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1900-60-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1900-61-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB