Resubmissions

07-09-2021 18:08

210907-wq7rdadba9 10

07-09-2021 17:57

210907-wjxylagcfn 10

Analysis

  • max time kernel
    1793s
  • max time network
    1705s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    07-09-2021 18:08

General

  • Target

    keygen-step-4/Crack.exe

  • Size

    56KB

  • MD5

    7126148bfe5ca4bf7e098d794122a9a3

  • SHA1

    3fe6be3ee8bf1a0c99139b146913c8c6acd7dd64

  • SHA256

    f8c0350d71e5dd14438d477f73915c4845290c7f0620656624722183b76013f5

  • SHA512

    0bec6450d1be17489436de7a5186dbcb88089edd4227c3b5484460c9368e5ca0a2d88c385d31989f449a5d8cc347057c80a997682d6c0ed1b9cfcb85c677eb48

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 18 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:352
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s SENS
      1⤵
        PID:1456
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2656
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2436
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
              PID:2428
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
              1⤵
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              PID:2320
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2272
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                  PID:1864
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1396
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1288
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1148
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                          PID:1064
                        • C:\Users\Admin\AppData\Local\Temp\keygen-step-4\Crack.exe
                          "C:\Users\Admin\AppData\Local\Temp\keygen-step-4\Crack.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:656
                          • C:\Users\Admin\AppData\Local\Temp\keygen-step-4\Crack.exe
                            "C:\Users\Admin\AppData\Local\Temp\keygen-step-4\Crack.exe" -a
                            2⤵
                              PID:3144
                          • \??\c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s BITS
                            1⤵
                            • Suspicious use of SetThreadContext
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1612
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                              2⤵
                              • Drops file in System32 directory
                              • Checks processor information in registry
                              • Modifies data under HKEY_USERS
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:728
                          • C:\Windows\system32\rundll32.exe
                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                            1⤵
                            • Process spawned unexpected child process
                            • Suspicious use of WriteProcessMemory
                            PID:192
                            • C:\Windows\SysWOW64\rundll32.exe
                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                              2⤵
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:940

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
                            MD5

                            982e6ffb7611a1cb05eedc930b8206d2

                            SHA1

                            26b988e751b5a9ada4ff4c5cbe70da0555297fdf

                            SHA256

                            4ada1e08c3f008eebcd55a54dab055341d6b2690bd4c02fb55803fd40539bc90

                            SHA512

                            362a9fb6054a2c43e7a113c29cb81a70babca9f6c3bb008200d5090af0b06dd5c11a6d2a1d33149d3f6958df9ed4445f2bd3f65d4e6414f275b9960741672890

                          • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                            MD5

                            4a6cfe6c785e9cfa0c326d11ec9c5a88

                            SHA1

                            3ee4edfd6fa0c8297634b0fff83c61c5f9ea3056

                            SHA256

                            5c41a6b98890b743dd67caa3a186bf248b31eba525bec19896eb7e23666ed872

                            SHA512

                            b0369510f94a5d402871660070ce61fa49e6f25ea0a509a17c83d71245a3609e8ee521c924290b9a99fb5e7faf378b3b88c255c02636b34643b2e6529f2813aa

                          • \Users\Admin\AppData\Local\Temp\sqlite.dll
                            MD5

                            4a6cfe6c785e9cfa0c326d11ec9c5a88

                            SHA1

                            3ee4edfd6fa0c8297634b0fff83c61c5f9ea3056

                            SHA256

                            5c41a6b98890b743dd67caa3a186bf248b31eba525bec19896eb7e23666ed872

                            SHA512

                            b0369510f94a5d402871660070ce61fa49e6f25ea0a509a17c83d71245a3609e8ee521c924290b9a99fb5e7faf378b3b88c255c02636b34643b2e6529f2813aa

                          • memory/352-187-0x000001F963330000-0x000001F9633A4000-memory.dmp
                            Filesize

                            464KB

                          • memory/352-147-0x000001F963240000-0x000001F9632B4000-memory.dmp
                            Filesize

                            464KB

                          • memory/728-121-0x00007FF7D1924060-mapping.dmp
                          • memory/728-167-0x000001F7B3C80000-0x000001F7B3C9B000-memory.dmp
                            Filesize

                            108KB

                          • memory/728-168-0x000001F7B4C00000-0x000001F7B4D06000-memory.dmp
                            Filesize

                            1.0MB

                          • memory/728-145-0x000001F7B2440000-0x000001F7B24B4000-memory.dmp
                            Filesize

                            464KB

                          • memory/940-134-0x0000000004030000-0x0000000004131000-memory.dmp
                            Filesize

                            1.0MB

                          • memory/940-116-0x0000000000000000-mapping.dmp
                          • memory/940-137-0x00000000041E0000-0x000000000423F000-memory.dmp
                            Filesize

                            380KB

                          • memory/1064-140-0x000001B747B10000-0x000001B747B84000-memory.dmp
                            Filesize

                            464KB

                          • memory/1064-191-0x000001B7481B0000-0x000001B748224000-memory.dmp
                            Filesize

                            464KB

                          • memory/1148-135-0x000001EB44680000-0x000001EB446F4000-memory.dmp
                            Filesize

                            464KB

                          • memory/1148-190-0x000001EB44F00000-0x000001EB44F74000-memory.dmp
                            Filesize

                            464KB

                          • memory/1288-161-0x0000027BB06A0000-0x0000027BB0714000-memory.dmp
                            Filesize

                            464KB

                          • memory/1288-194-0x0000027BB0790000-0x0000027BB0804000-memory.dmp
                            Filesize

                            464KB

                          • memory/1396-162-0x000001F47A300000-0x000001F47A374000-memory.dmp
                            Filesize

                            464KB

                          • memory/1396-195-0x000001F47A730000-0x000001F47A7A4000-memory.dmp
                            Filesize

                            464KB

                          • memory/1456-192-0x00000297D0400000-0x00000297D0474000-memory.dmp
                            Filesize

                            464KB

                          • memory/1456-146-0x00000297D0190000-0x00000297D0204000-memory.dmp
                            Filesize

                            464KB

                          • memory/1612-139-0x000001FDD61A0000-0x000001FDD61ED000-memory.dmp
                            Filesize

                            308KB

                          • memory/1612-120-0x000001FDD5EC0000-0x000001FDD5EC2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1612-169-0x000001FDD5ED0000-0x000001FDD5ED4000-memory.dmp
                            Filesize

                            16KB

                          • memory/1612-170-0x000001FDD5E00000-0x000001FDD5E01000-memory.dmp
                            Filesize

                            4KB

                          • memory/1612-171-0x000001FDD5E00000-0x000001FDD5E04000-memory.dmp
                            Filesize

                            16KB

                          • memory/1612-173-0x000001FDD3CF0000-0x000001FDD3CF4000-memory.dmp
                            Filesize

                            16KB

                          • memory/1612-142-0x000001FDD6260000-0x000001FDD62D4000-memory.dmp
                            Filesize

                            464KB

                          • memory/1864-193-0x000002B3AA080000-0x000002B3AA0F4000-memory.dmp
                            Filesize

                            464KB

                          • memory/1864-152-0x000002B3A9F80000-0x000002B3A9FF4000-memory.dmp
                            Filesize

                            464KB

                          • memory/2272-149-0x000001A2C5780000-0x000001A2C57F4000-memory.dmp
                            Filesize

                            464KB

                          • memory/2272-188-0x000001A2C5970000-0x000001A2C59E4000-memory.dmp
                            Filesize

                            464KB

                          • memory/2320-189-0x00000162511B0000-0x0000016251224000-memory.dmp
                            Filesize

                            464KB

                          • memory/2320-151-0x0000016250BD0000-0x0000016250C44000-memory.dmp
                            Filesize

                            464KB

                          • memory/2428-196-0x0000029E4CCB0000-0x0000029E4CD24000-memory.dmp
                            Filesize

                            464KB

                          • memory/2428-163-0x0000029E4CC30000-0x0000029E4CCA4000-memory.dmp
                            Filesize

                            464KB

                          • memory/2436-164-0x0000026CBD570000-0x0000026CBD5E4000-memory.dmp
                            Filesize

                            464KB

                          • memory/2436-197-0x0000026CBD9A0000-0x0000026CBDA14000-memory.dmp
                            Filesize

                            464KB

                          • memory/2656-143-0x000001C2C1750000-0x000001C2C17C4000-memory.dmp
                            Filesize

                            464KB

                          • memory/2656-186-0x000001C2C1D40000-0x000001C2C1DB4000-memory.dmp
                            Filesize

                            464KB

                          • memory/3144-114-0x0000000000000000-mapping.dmp