Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14/09/2021, 15:59

General

  • Target
    6da69b16cadbcc125175b5e4ab8520cd.exe
  • Size 99KB
  • Sample210914-te3beafhh4
  • SHA256 7263fbdb7378bb2a4522bae58a388d74b193bd2d73a8669f901d11e1481a1595
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 18 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
      PID:1144
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s UserManager
      1⤵
        PID:1396
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        PID:3056
        • C:\Users\Admin\AppData\Local\Temp\6da69b16cadbcc125175b5e4ab8520cd.exe
          "C:\Users\Admin\AppData\Local\Temp\6da69b16cadbcc125175b5e4ab8520cd.exe"
          2⤵
            PID:808
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2708
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2696
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Browser
            1⤵
            • Suspicious use of SetThreadContext
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2580
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k SystemNetworkService
              2⤵
              • Drops file in System32 directory
              • Checks processor information in registry
              • Modifies data under HKEY_USERS
              • Modifies registry class
              PID:2072
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
              PID:2448
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
              1⤵
                PID:2416
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:1936
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1408
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1092
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                      PID:1036
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:340
                      • C:\Windows\system32\rundll32.exe
                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                        1⤵
                        • Process spawned unexpected child process
                        • Suspicious use of WriteProcessMemory
                        PID:1460
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                          2⤵
                          • Loads dropped DLL
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1616

                      Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            memory/340-138-0x000001B51D200000-0x000001B51D274000-memory.dmp

                            memory/1036-139-0x00000247F60A0000-0x00000247F6114000-memory.dmp

                            memory/1092-132-0x000001442DBD0000-0x000001442DC44000-memory.dmp

                            memory/1144-157-0x00000194BEE40000-0x00000194BEEB4000-memory.dmp

                            memory/1396-158-0x000001DE69B60000-0x000001DE69BD4000-memory.dmp

                            memory/1408-144-0x000001B3FEE20000-0x000001B3FEE94000-memory.dmp

                            memory/1616-131-0x00000000048AA000-0x00000000049AB000-memory.dmp

                            memory/1616-133-0x00000000049B0000-0x0000000004A0F000-memory.dmp

                            memory/1936-156-0x0000021992460000-0x00000219924D4000-memory.dmp

                            memory/2072-141-0x000001B07E100000-0x000001B07E174000-memory.dmp

                            memory/2072-164-0x000001B000A00000-0x000001B000B06000-memory.dmp

                            memory/2072-163-0x000001B0000C0000-0x000001B0000DB000-memory.dmp

                            memory/2416-145-0x00000223B0A00000-0x00000223B0A74000-memory.dmp

                            memory/2448-143-0x000002D38C340000-0x000002D38C3B4000-memory.dmp

                            memory/2580-137-0x000001ECF73A0000-0x000001ECF7414000-memory.dmp

                            memory/2580-135-0x000001ECF6DD0000-0x000001ECF6E1D000-memory.dmp

                            memory/2696-159-0x0000022B03D00000-0x0000022B03D74000-memory.dmp

                            memory/2708-160-0x0000022088420000-0x0000022088494000-memory.dmp