Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-09-2021 23:08
Static task
static1
Behavioral task
behavioral1
Sample
2EBCA90B91D537CCF128E52E55D48BD2AC2563319DC07.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
2EBCA90B91D537CCF128E52E55D48BD2AC2563319DC07.exe
Resource
win10v20210408
General
-
Target
2EBCA90B91D537CCF128E52E55D48BD2AC2563319DC07.exe
-
Size
144KB
-
MD5
6d0941f64b7968007db7eef0a06a0cca
-
SHA1
0a9fe217013e7a27134ee5633f1c5e750b0604a6
-
SHA256
2ebca90b91d537ccf128e52e55d48bd2ac2563319dc07f9435942c42df9a4d8d
-
SHA512
dc85440765df6479284e08be40afc717631dab8fe9e150a32c456a12455fefb47164979652da87d42e7d0beb6f383bf8f762c124dc871365b6f41eea539c9ecc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 1768 server.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ee9b0e844c498eb2d84ba9782d98425.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ee9b0e844c498eb2d84ba9782d98425.exe server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\1ee9b0e844c498eb2d84ba9782d98425 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1ee9b0e844c498eb2d84ba9782d98425 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2EBCA90B91D537CCF128E52E55D48BD2AC2563319DC07.exeserver.exedescription pid process target process PID 804 wrote to memory of 1768 804 2EBCA90B91D537CCF128E52E55D48BD2AC2563319DC07.exe server.exe PID 804 wrote to memory of 1768 804 2EBCA90B91D537CCF128E52E55D48BD2AC2563319DC07.exe server.exe PID 804 wrote to memory of 1768 804 2EBCA90B91D537CCF128E52E55D48BD2AC2563319DC07.exe server.exe PID 1768 wrote to memory of 2920 1768 server.exe netsh.exe PID 1768 wrote to memory of 2920 1768 server.exe netsh.exe PID 1768 wrote to memory of 2920 1768 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2EBCA90B91D537CCF128E52E55D48BD2AC2563319DC07.exe"C:\Users\Admin\AppData\Local\Temp\2EBCA90B91D537CCF128E52E55D48BD2AC2563319DC07.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\server.exeMD5
6d0941f64b7968007db7eef0a06a0cca
SHA10a9fe217013e7a27134ee5633f1c5e750b0604a6
SHA2562ebca90b91d537ccf128e52e55d48bd2ac2563319dc07f9435942c42df9a4d8d
SHA512dc85440765df6479284e08be40afc717631dab8fe9e150a32c456a12455fefb47164979652da87d42e7d0beb6f383bf8f762c124dc871365b6f41eea539c9ecc
-
C:\Users\Admin\AppData\Roaming\server.exeMD5
6d0941f64b7968007db7eef0a06a0cca
SHA10a9fe217013e7a27134ee5633f1c5e750b0604a6
SHA2562ebca90b91d537ccf128e52e55d48bd2ac2563319dc07f9435942c42df9a4d8d
SHA512dc85440765df6479284e08be40afc717631dab8fe9e150a32c456a12455fefb47164979652da87d42e7d0beb6f383bf8f762c124dc871365b6f41eea539c9ecc
-
memory/804-114-0x00000000010D0000-0x00000000010D1000-memory.dmpFilesize
4KB
-
memory/1768-115-0x0000000000000000-mapping.dmp
-
memory/1768-118-0x0000000002210000-0x0000000002211000-memory.dmpFilesize
4KB
-
memory/2920-119-0x0000000000000000-mapping.dmp