Analysis
-
max time kernel
158s -
max time network
164s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
31-08-2021 06:53
Static task
static1
Behavioral task
behavioral1
Sample
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe
Resource
win7v20210408
General
-
Target
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe
-
Size
318KB
-
MD5
a49f8963a4c3949b06e4301caa2de435
-
SHA1
2784038e702ea56c70b56d0ba2dab6dac5512746
-
SHA256
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
-
SHA512
f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 3380 updater.exe -
Processes:
resource yara_rule C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe upx C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 2524 notepad.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exeupdater.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" updater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exeupdater.exedescription pid process Token: SeIncreaseQuotaPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeSecurityPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeTakeOwnershipPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeLoadDriverPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeSystemProfilePrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeSystemtimePrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeProfSingleProcessPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeIncBasePriorityPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeCreatePagefilePrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeBackupPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeRestorePrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeShutdownPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeDebugPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeSystemEnvironmentPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeChangeNotifyPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeRemoteShutdownPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeUndockPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeManageVolumePrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeImpersonatePrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeCreateGlobalPrivilege 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: 33 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: 34 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: 35 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: 36 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe Token: SeIncreaseQuotaPrivilege 3380 updater.exe Token: SeSecurityPrivilege 3380 updater.exe Token: SeTakeOwnershipPrivilege 3380 updater.exe Token: SeLoadDriverPrivilege 3380 updater.exe Token: SeSystemProfilePrivilege 3380 updater.exe Token: SeSystemtimePrivilege 3380 updater.exe Token: SeProfSingleProcessPrivilege 3380 updater.exe Token: SeIncBasePriorityPrivilege 3380 updater.exe Token: SeCreatePagefilePrivilege 3380 updater.exe Token: SeBackupPrivilege 3380 updater.exe Token: SeRestorePrivilege 3380 updater.exe Token: SeShutdownPrivilege 3380 updater.exe Token: SeDebugPrivilege 3380 updater.exe Token: SeSystemEnvironmentPrivilege 3380 updater.exe Token: SeChangeNotifyPrivilege 3380 updater.exe Token: SeRemoteShutdownPrivilege 3380 updater.exe Token: SeUndockPrivilege 3380 updater.exe Token: SeManageVolumePrivilege 3380 updater.exe Token: SeImpersonatePrivilege 3380 updater.exe Token: SeCreateGlobalPrivilege 3380 updater.exe Token: 33 3380 updater.exe Token: 34 3380 updater.exe Token: 35 3380 updater.exe Token: 36 3380 updater.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
updater.exepid process 3380 updater.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.execmd.execmd.exeupdater.exedescription pid process target process PID 640 wrote to memory of 3832 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 640 wrote to memory of 3832 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 640 wrote to memory of 3832 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 640 wrote to memory of 3852 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 640 wrote to memory of 3852 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 640 wrote to memory of 3852 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe cmd.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 640 wrote to memory of 2524 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe notepad.exe PID 3852 wrote to memory of 416 3852 cmd.exe attrib.exe PID 3852 wrote to memory of 416 3852 cmd.exe attrib.exe PID 3852 wrote to memory of 416 3852 cmd.exe attrib.exe PID 3832 wrote to memory of 4056 3832 cmd.exe attrib.exe PID 3832 wrote to memory of 4056 3832 cmd.exe attrib.exe PID 3832 wrote to memory of 4056 3832 cmd.exe attrib.exe PID 640 wrote to memory of 3380 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe updater.exe PID 640 wrote to memory of 3380 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe updater.exe PID 640 wrote to memory of 3380 640 074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe updater.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe PID 3380 wrote to memory of 3908 3380 updater.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4056 attrib.exe 416 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe"C:\Users\Admin\AppData\Local\Temp\074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe"C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exeMD5
a49f8963a4c3949b06e4301caa2de435
SHA12784038e702ea56c70b56d0ba2dab6dac5512746
SHA256074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
SHA512f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exeMD5
a49f8963a4c3949b06e4301caa2de435
SHA12784038e702ea56c70b56d0ba2dab6dac5512746
SHA256074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
SHA512f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
memory/416-118-0x0000000000000000-mapping.dmp
-
memory/640-114-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB
-
memory/2524-126-0x00000000004F0000-0x000000000059E000-memory.dmpFilesize
696KB
-
memory/2524-117-0x0000000000000000-mapping.dmp
-
memory/3380-120-0x0000000000000000-mapping.dmp
-
memory/3380-124-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/3832-115-0x0000000000000000-mapping.dmp
-
memory/3852-116-0x0000000000000000-mapping.dmp
-
memory/3908-123-0x0000000000000000-mapping.dmp
-
memory/3908-125-0x0000000003300000-0x0000000003301000-memory.dmpFilesize
4KB
-
memory/4056-119-0x0000000000000000-mapping.dmp