833ab773ed2c4e4cd2581d1e42bc5471f0621786007a8846aaf6cdfeccb198c2

Analysis

max time kernel
148s
max time network
142s
platform
windows7_x64
resource
win7-en-20210920
submitted
30/09/2021, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe
Size 1.9MB
Sample210930-1bbgvaaefq
SHA256 833ab773ed2c4e4cd2581d1e42bc5471f0621786007a8846aaf6cdfeccb198c2
MD5 f04728ce0ea25c31c9546ba066e36fc1
SHA1 f15899375be51758b2ca9df38405ee27d5237a16
SHA512 e46f00b196ceba931f6a00daa3c1f2808acbc2f5791951aee89b5722fdfa3456cca50c643aef178e8d2cdae77c20fed1900b9f31429231973ba04bdde20c4530
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1544	itstartup.exe
1400	svchost32.exe
1064	itstartup.exe
1648	svchost32.exe
1472	sihost32.exe

Loads dropped DLL 4 IoCs

pid	Process
1768	cmd.exe
1400	svchost32.exe
1864	cmd.exe
1648	svchost32.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\system32\itstartup.exe	svchost32.exe
File opened for modification	C:\Windows\system32\itstartup.exe	svchost32.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\Microsoft\Telemetry\sihost32.exe	svchost32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\itstartup.exe	SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
472	schtasks.exe
668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1444	powershell.exe
1148	powershell.exe
968	powershell.exe
1924	powershell.exe
1864	powershell.exe
1744	powershell.exe
1400	svchost32.exe
960	powershell.exe
1936	powershell.exe
1824	powershell.exe
1708	powershell.exe
1648	svchost32.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	1400	svchost32.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1648	svchost32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1368	1768	SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe	27
PID 1768 wrote to memory of 1368	1768	SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe	27
PID 1768 wrote to memory of 1368	1768	SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe	27
PID 1768 wrote to memory of 1368	1768	SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe	27
PID 1768 wrote to memory of 2032	1768	SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe	29
PID 1768 wrote to memory of 2032	1768	SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe	29
PID 1768 wrote to memory of 2032	1768	SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe	29
PID 1768 wrote to memory of 2032	1768	SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe	29
PID 2032 wrote to memory of 1544	2032	cmd.exe	31
PID 2032 wrote to memory of 1544	2032	cmd.exe	31
PID 2032 wrote to memory of 1544	2032	cmd.exe	31
PID 2032 wrote to memory of 1544	2032	cmd.exe	31
PID 1368 wrote to memory of 1444	1368	cmd.exe	32
PID 1368 wrote to memory of 1444	1368	cmd.exe	32
PID 1368 wrote to memory of 1444	1368	cmd.exe	32
PID 1368 wrote to memory of 1444	1368	cmd.exe	32
PID 1544 wrote to memory of 836	1544	itstartup.exe	33
PID 1544 wrote to memory of 836	1544	itstartup.exe	33
PID 1544 wrote to memory of 836	1544	itstartup.exe	33
PID 836 wrote to memory of 1148	836	cmd.exe	35
PID 836 wrote to memory of 1148	836	cmd.exe	35
PID 836 wrote to memory of 1148	836	cmd.exe	35
PID 836 wrote to memory of 968	836	cmd.exe	36
PID 836 wrote to memory of 968	836	cmd.exe	36
PID 836 wrote to memory of 968	836	cmd.exe	36
PID 1368 wrote to memory of 1924	1368	cmd.exe	37
PID 1368 wrote to memory of 1924	1368	cmd.exe	37
PID 1368 wrote to memory of 1924	1368	cmd.exe	37
PID 1368 wrote to memory of 1924	1368	cmd.exe	37
PID 836 wrote to memory of 1864	836	cmd.exe	38
PID 836 wrote to memory of 1864	836	cmd.exe	38
PID 836 wrote to memory of 1864	836	cmd.exe	38
PID 836 wrote to memory of 1744	836	cmd.exe	39
PID 836 wrote to memory of 1744	836	cmd.exe	39
PID 836 wrote to memory of 1744	836	cmd.exe	39
PID 1544 wrote to memory of 1768	1544	itstartup.exe	40
PID 1544 wrote to memory of 1768	1544	itstartup.exe	40
PID 1544 wrote to memory of 1768	1544	itstartup.exe	40
PID 1768 wrote to memory of 1400	1768	cmd.exe	42
PID 1768 wrote to memory of 1400	1768	cmd.exe	42
PID 1768 wrote to memory of 1400	1768	cmd.exe	42
PID 1400 wrote to memory of 816	1400	svchost32.exe	43
PID 1400 wrote to memory of 816	1400	svchost32.exe	43
PID 1400 wrote to memory of 816	1400	svchost32.exe	43
PID 816 wrote to memory of 472	816	cmd.exe	45
PID 816 wrote to memory of 472	816	cmd.exe	45
PID 816 wrote to memory of 472	816	cmd.exe	45
PID 1400 wrote to memory of 1064	1400	svchost32.exe	46
PID 1400 wrote to memory of 1064	1400	svchost32.exe	46
PID 1400 wrote to memory of 1064	1400	svchost32.exe	46
PID 1400 wrote to memory of 1480	1400	svchost32.exe	47
PID 1400 wrote to memory of 1480	1400	svchost32.exe	47
PID 1400 wrote to memory of 1480	1400	svchost32.exe	47
PID 1064 wrote to memory of 108	1064	itstartup.exe	49
PID 1064 wrote to memory of 108	1064	itstartup.exe	49
PID 1064 wrote to memory of 108	1064	itstartup.exe	49
PID 1480 wrote to memory of 548	1480	cmd.exe	51
PID 1480 wrote to memory of 548	1480	cmd.exe	51
PID 1480 wrote to memory of 548	1480	cmd.exe	51
PID 108 wrote to memory of 960	108	cmd.exe	52
PID 108 wrote to memory of 960	108	cmd.exe	52
PID 108 wrote to memory of 960	108	cmd.exe	52
PID 108 wrote to memory of 1936	108	cmd.exe	53
PID 108 wrote to memory of 1936	108	cmd.exe	53

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.FakeAlert.2.2851.11805.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Windows\itstartup.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\itstartup.exe
    C:\Windows\itstartup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\system32\cmd.exe
      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\itstartup.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\svchost32.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\itstartup.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1400
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "itstartup" /tr '"C:\Windows\system32\itstartup.exe"' & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "itstartup" /tr '"C:\Windows\system32\itstartup.exe"'
        7⤵
        Creates scheduled task(s)
        
        PID:472
      - C:\Windows\system32\itstartup.exe
        
        "C:\Windows\system32\itstartup.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Windows\system32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        8⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        8⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        8⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
        8⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\itstartup.exe"
        7⤵
        Loads dropped DLL
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\svchost32.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\itstartup.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "itstartup" /tr '"C:\Windows\system32\itstartup.exe"' & exit
        9⤵
        
        PID:568
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "itstartup" /tr '"C:\Windows\system32\itstartup.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:668
        
        C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
        
        "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
        9⤵
        Executes dropped EXE
        
        PID:1472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
        9⤵
        
        PID:364
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        10⤵
        
        PID:1672
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        7⤵
        
        PID:548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-138-0x0000000001F7B000-0x0000000001F9A000-memory.dmp

Download

memory/960-134-0x000007FEED310000-0x000007FEEDE6D000-memory.dmp

Download

memory/960-136-0x0000000001F72000-0x0000000001F74000-memory.dmp

Download

memory/960-137-0x0000000001F74000-0x0000000001F77000-memory.dmp

Download

memory/960-135-0x0000000001F70000-0x0000000001F72000-memory.dmp

Download

memory/968-81-0x000007FEECDD0000-0x000007FEED92D000-memory.dmp

Download

memory/968-95-0x000000000253B000-0x000000000255A000-memory.dmp

Download

memory/968-82-0x0000000002530000-0x0000000002532000-memory.dmp

Download

memory/968-84-0x0000000002532000-0x0000000002534000-memory.dmp

Download

memory/968-85-0x0000000002534000-0x0000000002537000-memory.dmp

Download

memory/968-88-0x000000001B800000-0x000000001BAFF000-memory.dmp

Download

memory/1064-131-0x000000001BC20000-0x000000001BC22000-memory.dmp

Download

memory/1064-124-0x000000013FF00000-0x000000013FF01000-memory.dmp

Download

memory/1148-71-0x0000000002332000-0x0000000002334000-memory.dmp

Download

memory/1148-72-0x0000000002334000-0x0000000002337000-memory.dmp

Download

memory/1148-79-0x000000000233B000-0x000000000235A000-memory.dmp

Download

memory/1148-74-0x000000001B760000-0x000000001BA5F000-memory.dmp

Download

memory/1148-65-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download

memory/1148-69-0x000007FEECDD0000-0x000007FEED92D000-memory.dmp

Download

memory/1148-70-0x0000000002330000-0x0000000002332000-memory.dmp

Download

memory/1400-119-0x00000000024C0000-0x00000000024C2000-memory.dmp

Download

memory/1400-115-0x000000013FB60000-0x000000013FB61000-memory.dmp

Download

memory/1444-60-0x0000000075821000-0x0000000075823000-memory.dmp

Download

memory/1444-67-0x00000000024C1000-0x00000000024C2000-memory.dmp

Download

memory/1444-66-0x00000000024C0000-0x00000000024C1000-memory.dmp

Download

memory/1444-68-0x00000000024C2000-0x00000000024C4000-memory.dmp

Download

memory/1472-180-0x0000000000A50000-0x0000000000A52000-memory.dmp

Download

memory/1472-177-0x000000013F040000-0x000000013F041000-memory.dmp

Download

memory/1544-61-0x000000013F300000-0x000000013F301000-memory.dmp

Download

memory/1544-73-0x000000001BEC0000-0x000000001BEC2000-memory.dmp

Download

memory/1648-169-0x000000013F920000-0x000000013F921000-memory.dmp

Download

memory/1648-179-0x000000001BC00000-0x000000001BC02000-memory.dmp

Download

memory/1708-162-0x000000000283B000-0x000000000285A000-memory.dmp

Download

memory/1708-159-0x000007FEED310000-0x000007FEEDE6D000-memory.dmp

Download

memory/1708-160-0x0000000002830000-0x0000000002832000-memory.dmp

Download

memory/1708-161-0x0000000002832000-0x0000000002834000-memory.dmp

Download

memory/1708-163-0x0000000002834000-0x0000000002837000-memory.dmp

Download

memory/1744-106-0x00000000029E2000-0x00000000029E4000-memory.dmp

Download

memory/1744-108-0x000000001B7F0000-0x000000001BAEF000-memory.dmp

Download

memory/1744-109-0x00000000029EB000-0x0000000002A0A000-memory.dmp

Download

memory/1744-107-0x00000000029E4000-0x00000000029E7000-memory.dmp

Download

memory/1744-104-0x000007FEECDD0000-0x000007FEED92D000-memory.dmp

Download

memory/1744-105-0x00000000029E0000-0x00000000029E2000-memory.dmp

Download

memory/1824-151-0x000007FEED310000-0x000007FEEDE6D000-memory.dmp

Download

memory/1824-155-0x00000000027FB000-0x000000000281A000-memory.dmp

Download

memory/1824-154-0x00000000027F4000-0x00000000027F7000-memory.dmp

Download

memory/1824-152-0x00000000027F0000-0x00000000027F2000-memory.dmp

Download

memory/1824-153-0x00000000027F2000-0x00000000027F4000-memory.dmp

Download

memory/1864-93-0x000007FEECDD0000-0x000007FEED92D000-memory.dmp

Download

memory/1864-100-0x000000000253B000-0x000000000255A000-memory.dmp

Download

memory/1864-99-0x000000001B860000-0x000000001BB5F000-memory.dmp

Download

memory/1864-97-0x0000000002532000-0x0000000002534000-memory.dmp

Download

memory/1864-98-0x0000000002534000-0x0000000002537000-memory.dmp

Download

memory/1864-96-0x0000000002530000-0x0000000002532000-memory.dmp

Download

memory/1924-94-0x0000000001DC2000-0x0000000001DC4000-memory.dmp

Download

memory/1924-86-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Download

memory/1924-87-0x0000000001DC1000-0x0000000001DC2000-memory.dmp

Download

memory/1936-142-0x000007FEED310000-0x000007FEEDE6D000-memory.dmp

Download

memory/1936-146-0x00000000024FB000-0x000000000251A000-memory.dmp

Download

memory/1936-144-0x00000000024F2000-0x00000000024F4000-memory.dmp

Download

memory/1936-143-0x00000000024F0000-0x00000000024F2000-memory.dmp

Download

memory/1936-145-0x00000000024F4000-0x00000000024F7000-memory.dmp

Download