Analysis
-
max time kernel
153s -
max time network
185s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-09-2021 06:12
Static task
static1
Behavioral task
behavioral1
Sample
864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exe
Resource
win10-en-20210920
General
-
Target
864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exe
-
Size
92KB
-
MD5
d136709b5b24d88ea5e2f42821a5a996
-
SHA1
ce1371e3e78173266a95370856ad24412aaa9b23
-
SHA256
864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a
-
SHA512
5642bef456efcb67dc7788a7af5296e5c856d66a10e31a0ff140641226f176d6c573e848bc3ad1680b8279f9a92bef6c7683f1a62b92df6f4883299df2c0bc6a
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Chrome.exepid process 1364 Chrome.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exepid process 1928 864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Chrome.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\9174f01a6e44cbc9af1239d5bb1d7327 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Chrome.exe\" .." Chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9174f01a6e44cbc9af1239d5bb1d7327 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Chrome.exe\" .." Chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
Chrome.exedescription pid process Token: SeDebugPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe Token: 33 1364 Chrome.exe Token: SeIncBasePriorityPrivilege 1364 Chrome.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exeChrome.exedescription pid process target process PID 1928 wrote to memory of 1364 1928 864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exe Chrome.exe PID 1928 wrote to memory of 1364 1928 864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exe Chrome.exe PID 1928 wrote to memory of 1364 1928 864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exe Chrome.exe PID 1928 wrote to memory of 1364 1928 864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exe Chrome.exe PID 1364 wrote to memory of 1580 1364 Chrome.exe netsh.exe PID 1364 wrote to memory of 1580 1364 Chrome.exe netsh.exe PID 1364 wrote to memory of 1580 1364 Chrome.exe netsh.exe PID 1364 wrote to memory of 1580 1364 Chrome.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exe"C:\Users\Admin\AppData\Local\Temp\864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exe"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Chrome.exe" "Chrome.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exeMD5
d136709b5b24d88ea5e2f42821a5a996
SHA1ce1371e3e78173266a95370856ad24412aaa9b23
SHA256864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a
SHA5125642bef456efcb67dc7788a7af5296e5c856d66a10e31a0ff140641226f176d6c573e848bc3ad1680b8279f9a92bef6c7683f1a62b92df6f4883299df2c0bc6a
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exeMD5
d136709b5b24d88ea5e2f42821a5a996
SHA1ce1371e3e78173266a95370856ad24412aaa9b23
SHA256864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a
SHA5125642bef456efcb67dc7788a7af5296e5c856d66a10e31a0ff140641226f176d6c573e848bc3ad1680b8279f9a92bef6c7683f1a62b92df6f4883299df2c0bc6a
-
\Users\Admin\AppData\Local\Temp\Chrome.exeMD5
d136709b5b24d88ea5e2f42821a5a996
SHA1ce1371e3e78173266a95370856ad24412aaa9b23
SHA256864259b607ed3dd2fc8873cd2e0fcbbb1b156bbf67afb55cbc41b8a83ae81b9a
SHA5125642bef456efcb67dc7788a7af5296e5c856d66a10e31a0ff140641226f176d6c573e848bc3ad1680b8279f9a92bef6c7683f1a62b92df6f4883299df2c0bc6a
-
memory/1364-70-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB
-
memory/1364-67-0x0000000000000000-mapping.dmp
-
memory/1364-74-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/1580-76-0x0000000000000000-mapping.dmp
-
memory/1580-77-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/1928-65-0x0000000000340000-0x0000000000349000-memory.dmpFilesize
36KB
-
memory/1928-64-0x0000000002300000-0x0000000002301000-memory.dmpFilesize
4KB
-
memory/1928-63-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1928-62-0x00000000003E0000-0x0000000000400000-memory.dmpFilesize
128KB
-
memory/1928-60-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB