Analysis

  • max time kernel
    128s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    16/10/2021, 14:16

General

  • Target

    22160bff37828b82230aefd166033aad94ba11087c2bcabe744c14304b98724c.exe

  • Size

    96KB

  • MD5

    17d00ffe0063ec458371dac451603184

  • SHA1

    b0b4d2802cd1c42e8e50f37e2bd03b457fd6b9b6

  • SHA256

    22160bff37828b82230aefd166033aad94ba11087c2bcabe744c14304b98724c

  • SHA512

    7f6b90e03427635c9ee72c4e4c3a90d19c123950391e24ea5f4f232ffb93507055e6269c0998c0a2760e16b341a034d5f949f9d70c7187b5b97624b748308aa1

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 18 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
      PID:1048
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
      1⤵
        PID:372
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s BITS
        1⤵
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4024
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Drops file in System32 directory
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3948
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2840
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2716
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2708
            • C:\Windows\system32\wbem\WMIADAP.EXE
              wmiadap.exe /F /T /R
              2⤵
                PID:3784
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
              1⤵
                PID:2456
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                1⤵
                  PID:2428
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                  1⤵
                    PID:1872
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                    1⤵
                      PID:1476
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s SENS
                      1⤵
                        PID:1404
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Themes
                        1⤵
                          PID:1192
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                          1⤵
                          • Modifies registry class
                          PID:1180
                        • C:\Users\Admin\AppData\Local\Temp\22160bff37828b82230aefd166033aad94ba11087c2bcabe744c14304b98724c.exe
                          "C:\Users\Admin\AppData\Local\Temp\22160bff37828b82230aefd166033aad94ba11087c2bcabe744c14304b98724c.exe"
                          1⤵
                            PID:2180
                          • C:\Windows\system32\rundll32.exe
                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                            1⤵
                            • Process spawned unexpected child process
                            • Suspicious use of WriteProcessMemory
                            PID:3012
                            • C:\Windows\SysWOW64\rundll32.exe
                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                              2⤵
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2296

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/372-188-0x000001E398B40000-0x000001E398BB2000-memory.dmp

                            Filesize

                            456KB

                          • memory/372-176-0x000001E397CF0000-0x000001E397CF2000-memory.dmp

                            Filesize

                            8KB

                          • memory/372-152-0x000001E398520000-0x000001E398592000-memory.dmp

                            Filesize

                            456KB

                          • memory/372-127-0x000001E397CF0000-0x000001E397CF2000-memory.dmp

                            Filesize

                            8KB

                          • memory/372-126-0x000001E397CF0000-0x000001E397CF2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1048-135-0x000001F6889F0000-0x000001F6889F2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1048-160-0x000001F689260000-0x000001F6892D2000-memory.dmp

                            Filesize

                            456KB

                          • memory/1048-192-0x000001F689380000-0x000001F6893F2000-memory.dmp

                            Filesize

                            456KB

                          • memory/1048-180-0x000001F6889F0000-0x000001F6889F2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1048-134-0x000001F6889F0000-0x000001F6889F2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1180-133-0x00000212405D0000-0x00000212405D2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1180-191-0x0000021241170000-0x00000212411E2000-memory.dmp

                            Filesize

                            456KB

                          • memory/1180-158-0x0000021240F80000-0x0000021240FF2000-memory.dmp

                            Filesize

                            456KB

                          • memory/1180-179-0x00000212405D0000-0x00000212405D2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1180-132-0x00000212405D0000-0x00000212405D2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1192-195-0x000001FBC1830000-0x000001FBC18A2000-memory.dmp

                            Filesize

                            456KB

                          • memory/1192-143-0x000001FBC0C10000-0x000001FBC0C12000-memory.dmp

                            Filesize

                            8KB

                          • memory/1192-183-0x000001FBC0C10000-0x000001FBC0C12000-memory.dmp

                            Filesize

                            8KB

                          • memory/1192-141-0x000001FBC0C10000-0x000001FBC0C12000-memory.dmp

                            Filesize

                            8KB

                          • memory/1192-145-0x000001FBC1740000-0x000001FBC17B2000-memory.dmp

                            Filesize

                            456KB

                          • memory/1404-162-0x000002D286000000-0x000002D286072000-memory.dmp

                            Filesize

                            456KB

                          • memory/1404-136-0x000002D2856B0000-0x000002D2856B2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1404-137-0x000002D2856B0000-0x000002D2856B2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1404-193-0x000002D286080000-0x000002D2860F2000-memory.dmp

                            Filesize

                            456KB

                          • memory/1404-181-0x000002D2856B0000-0x000002D2856B2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1476-151-0x0000027930C70000-0x0000027930CE2000-memory.dmp

                            Filesize

                            456KB

                          • memory/1476-148-0x00000279302F0000-0x00000279302F2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1476-184-0x00000279302F0000-0x00000279302F2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1476-196-0x00000279310A0000-0x0000027931112000-memory.dmp

                            Filesize

                            456KB

                          • memory/1476-149-0x00000279302F0000-0x00000279302F2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1872-182-0x000002CE5EAB0000-0x000002CE5EAB2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1872-139-0x000002CE5EAB0000-0x000002CE5EAB2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1872-138-0x000002CE5EAB0000-0x000002CE5EAB2000-memory.dmp

                            Filesize

                            8KB

                          • memory/1872-164-0x000002CE5F6B0000-0x000002CE5F722000-memory.dmp

                            Filesize

                            456KB

                          • memory/1872-194-0x000002CE5F7A0000-0x000002CE5F812000-memory.dmp

                            Filesize

                            456KB

                          • memory/2296-140-0x00000000042EB000-0x00000000043EC000-memory.dmp

                            Filesize

                            1.0MB

                          • memory/2296-142-0x00000000041A0000-0x00000000041FD000-memory.dmp

                            Filesize

                            372KB

                          • memory/2428-177-0x000001AD6B960000-0x000001AD6B962000-memory.dmp

                            Filesize

                            8KB

                          • memory/2428-129-0x000001AD6B960000-0x000001AD6B962000-memory.dmp

                            Filesize

                            8KB

                          • memory/2428-153-0x000001AD6BC10000-0x000001AD6BC82000-memory.dmp

                            Filesize

                            456KB

                          • memory/2428-128-0x000001AD6B960000-0x000001AD6B962000-memory.dmp

                            Filesize

                            8KB

                          • memory/2428-189-0x000001AD6C370000-0x000001AD6C3E2000-memory.dmp

                            Filesize

                            456KB

                          • memory/2456-190-0x0000016A10950000-0x0000016A109C2000-memory.dmp

                            Filesize

                            456KB

                          • memory/2456-131-0x0000016A10100000-0x0000016A10102000-memory.dmp

                            Filesize

                            8KB

                          • memory/2456-155-0x0000016A10880000-0x0000016A108F2000-memory.dmp

                            Filesize

                            456KB

                          • memory/2456-130-0x0000016A10100000-0x0000016A10102000-memory.dmp

                            Filesize

                            8KB

                          • memory/2456-178-0x0000016A10100000-0x0000016A10102000-memory.dmp

                            Filesize

                            8KB

                          • memory/2708-197-0x0000022349830000-0x00000223498A2000-memory.dmp

                            Filesize

                            456KB

                          • memory/2708-185-0x0000022348BE0000-0x0000022348BE2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2708-156-0x0000022348BE0000-0x0000022348BE2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2708-157-0x00000223494A0000-0x0000022349512000-memory.dmp

                            Filesize

                            456KB

                          • memory/2708-154-0x0000022348BE0000-0x0000022348BE2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2716-198-0x00000207B8950000-0x00000207B89C2000-memory.dmp

                            Filesize

                            456KB

                          • memory/2716-161-0x00000207B7FE0000-0x00000207B7FE2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2716-186-0x00000207B7FE0000-0x00000207B7FE2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2716-163-0x00000207B8810000-0x00000207B8882000-memory.dmp

                            Filesize

                            456KB

                          • memory/2716-159-0x00000207B7FE0000-0x00000207B7FE2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2840-187-0x000001AFDD380000-0x000001AFDD3F2000-memory.dmp

                            Filesize

                            456KB

                          • memory/2840-147-0x000001AFDD2A0000-0x000001AFDD312000-memory.dmp

                            Filesize

                            456KB

                          • memory/2840-122-0x000001AFDCBE0000-0x000001AFDCBE2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2840-175-0x000001AFDCBE0000-0x000001AFDCBE2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2840-123-0x000001AFDCBE0000-0x000001AFDCBE2000-memory.dmp

                            Filesize

                            8KB

                          • memory/3948-168-0x0000022223300000-0x0000022223406000-memory.dmp

                            Filesize

                            1.0MB

                          • memory/3948-166-0x00000222222A0000-0x00000222222A2000-memory.dmp

                            Filesize

                            8KB

                          • memory/3948-165-0x00000222222A0000-0x00000222222A2000-memory.dmp

                            Filesize

                            8KB

                          • memory/3948-125-0x00000222222A0000-0x00000222222A2000-memory.dmp

                            Filesize

                            8KB

                          • memory/3948-150-0x0000022220950000-0x00000222209C2000-memory.dmp

                            Filesize

                            456KB

                          • memory/3948-167-0x00000222222E0000-0x00000222222FB000-memory.dmp

                            Filesize

                            108KB

                          • memory/3948-124-0x00000222222A0000-0x00000222222A2000-memory.dmp

                            Filesize

                            8KB

                          • memory/4024-171-0x000001ED06500000-0x000001ED06501000-memory.dmp

                            Filesize

                            4KB

                          • memory/4024-172-0x000001ED06500000-0x000001ED06504000-memory.dmp

                            Filesize

                            16KB

                          • memory/4024-174-0x000001ED06420000-0x000001ED06424000-memory.dmp

                            Filesize

                            16KB

                          • memory/4024-144-0x000001ED064B0000-0x000001ED064FD000-memory.dmp

                            Filesize

                            308KB

                          • memory/4024-119-0x000001ED06490000-0x000001ED06492000-memory.dmp

                            Filesize

                            8KB

                          • memory/4024-120-0x000001ED06490000-0x000001ED06492000-memory.dmp

                            Filesize

                            8KB

                          • memory/4024-170-0x000001ED06510000-0x000001ED06514000-memory.dmp

                            Filesize

                            16KB

                          • memory/4024-146-0x000001ED06830000-0x000001ED068A2000-memory.dmp

                            Filesize

                            456KB