Analysis

  • max time kernel
    147s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    17/10/2021, 20:35

General

  • Target

    17d00ffe0063ec458371dac451603184.exe

  • Size

    96KB

  • MD5

    17d00ffe0063ec458371dac451603184

  • SHA1

    b0b4d2802cd1c42e8e50f37e2bd03b457fd6b9b6

  • SHA256

    22160bff37828b82230aefd166033aad94ba11087c2bcabe744c14304b98724c

  • SHA512

    7f6b90e03427635c9ee72c4e4c3a90d19c123950391e24ea5f4f232ffb93507055e6269c0998c0a2760e16b341a034d5f949f9d70c7187b5b97624b748308aa1

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata: ET MALWARE ClipBanker Variant Activity (POST)

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 18 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2388
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s BITS
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k SystemNetworkService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1576
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2744
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Windows\system32\wbem\WMIADAP.EXE
        wmiadap.exe /F /T /R
        2⤵
          PID:2192
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2584
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2416
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1964
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1380
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                • Modifies registry class
                PID:1352
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1188
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1100
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                      PID:1008
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:68
                      • C:\Users\Admin\AppData\Local\Temp\17d00ffe0063ec458371dac451603184.exe
                        "C:\Users\Admin\AppData\Local\Temp\17d00ffe0063ec458371dac451603184.exe"
                        1⤵
                          PID:1656
                        • C:\Windows\system32\rundll32.exe
                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                          1⤵
                          • Process spawned unexpected child process
                          • Suspicious use of WriteProcessMemory
                          PID:1916
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                            2⤵
                            • Loads dropped DLL
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2908

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/68-128-0x00000216A69D0000-0x00000216A69D2000-memory.dmp

                          Filesize

                          8KB

                        • memory/68-176-0x00000216A69D0000-0x00000216A69D2000-memory.dmp

                          Filesize

                          8KB

                        • memory/68-150-0x00000216A6A10000-0x00000216A6A82000-memory.dmp

                          Filesize

                          456KB

                        • memory/68-188-0x00000216A6C00000-0x00000216A6C72000-memory.dmp

                          Filesize

                          456KB

                        • memory/68-129-0x00000216A69D0000-0x00000216A69D2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1008-180-0x000001DA9E180000-0x000001DA9E182000-memory.dmp

                          Filesize

                          8KB

                        • memory/1008-136-0x000001DA9E180000-0x000001DA9E182000-memory.dmp

                          Filesize

                          8KB

                        • memory/1008-137-0x000001DA9E180000-0x000001DA9E182000-memory.dmp

                          Filesize

                          8KB

                        • memory/1008-159-0x000001DA9EF40000-0x000001DA9EFB2000-memory.dmp

                          Filesize

                          456KB

                        • memory/1008-192-0x000001DA9EFC0000-0x000001DA9F032000-memory.dmp

                          Filesize

                          456KB

                        • memory/1100-191-0x0000014BABB30000-0x0000014BABBA2000-memory.dmp

                          Filesize

                          456KB

                        • memory/1100-156-0x0000014BABA40000-0x0000014BABAB2000-memory.dmp

                          Filesize

                          456KB

                        • memory/1100-134-0x0000014BAAD10000-0x0000014BAAD12000-memory.dmp

                          Filesize

                          8KB

                        • memory/1100-135-0x0000014BAAD10000-0x0000014BAAD12000-memory.dmp

                          Filesize

                          8KB

                        • memory/1100-179-0x0000014BAAD10000-0x0000014BAAD12000-memory.dmp

                          Filesize

                          8KB

                        • memory/1188-195-0x00000163E1170000-0x00000163E11E2000-memory.dmp

                          Filesize

                          456KB

                        • memory/1188-142-0x00000163E0960000-0x00000163E0962000-memory.dmp

                          Filesize

                          8KB

                        • memory/1188-143-0x00000163E0960000-0x00000163E0962000-memory.dmp

                          Filesize

                          8KB

                        • memory/1188-183-0x00000163E0960000-0x00000163E0962000-memory.dmp

                          Filesize

                          8KB

                        • memory/1188-164-0x00000163E1080000-0x00000163E10F2000-memory.dmp

                          Filesize

                          456KB

                        • memory/1352-196-0x000002C481340000-0x000002C4813B2000-memory.dmp

                          Filesize

                          456KB

                        • memory/1352-148-0x000002C480DE0000-0x000002C480DE2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1352-151-0x000002C480D60000-0x000002C480DD2000-memory.dmp

                          Filesize

                          456KB

                        • memory/1352-146-0x000002C480DE0000-0x000002C480DE2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1352-184-0x000002C480DE0000-0x000002C480DE2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1380-161-0x0000023AE0F70000-0x0000023AE0FE2000-memory.dmp

                          Filesize

                          456KB

                        • memory/1380-138-0x0000023AE06C0000-0x0000023AE06C2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1380-139-0x0000023AE06C0000-0x0000023AE06C2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1380-193-0x0000023AE1050000-0x0000023AE10C2000-memory.dmp

                          Filesize

                          456KB

                        • memory/1380-181-0x0000023AE06C0000-0x0000023AE06C2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1576-126-0x0000026E9F7D0000-0x0000026E9F7D2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1576-149-0x0000026E9F900000-0x0000026E9F972000-memory.dmp

                          Filesize

                          456KB

                        • memory/1576-165-0x0000026E9F7D0000-0x0000026E9F7D2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1576-127-0x0000026E9F7D0000-0x0000026E9F7D2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1576-167-0x0000026EA11C0000-0x0000026EA11DB000-memory.dmp

                          Filesize

                          108KB

                        • memory/1576-168-0x0000026EA2000000-0x0000026EA2106000-memory.dmp

                          Filesize

                          1.0MB

                        • memory/1576-166-0x0000026E9F7D0000-0x0000026E9F7D2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1964-182-0x0000020F53600000-0x0000020F53602000-memory.dmp

                          Filesize

                          8KB

                        • memory/1964-140-0x0000020F53600000-0x0000020F53602000-memory.dmp

                          Filesize

                          8KB

                        • memory/1964-194-0x0000020F54340000-0x0000020F543B2000-memory.dmp

                          Filesize

                          456KB

                        • memory/1964-163-0x0000020F53980000-0x0000020F539F2000-memory.dmp

                          Filesize

                          456KB

                        • memory/1964-141-0x0000020F53600000-0x0000020F53602000-memory.dmp

                          Filesize

                          8KB

                        • memory/2264-145-0x0000023D16DA0000-0x0000023D16E12000-memory.dmp

                          Filesize

                          456KB

                        • memory/2264-171-0x0000023D16AB0000-0x0000023D16AB1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2264-172-0x0000023D16AB0000-0x0000023D16AB4000-memory.dmp

                          Filesize

                          16KB

                        • memory/2264-174-0x0000023D16980000-0x0000023D16984000-memory.dmp

                          Filesize

                          16KB

                        • memory/2264-122-0x0000023D147E0000-0x0000023D147E2000-memory.dmp

                          Filesize

                          8KB

                        • memory/2264-121-0x0000023D147E0000-0x0000023D147E2000-memory.dmp

                          Filesize

                          8KB

                        • memory/2264-170-0x0000023D16AC0000-0x0000023D16AC4000-memory.dmp

                          Filesize

                          16KB

                        • memory/2264-144-0x0000023D16CE0000-0x0000023D16D2D000-memory.dmp

                          Filesize

                          308KB

                        • memory/2388-154-0x0000024C42100000-0x0000024C42172000-memory.dmp

                          Filesize

                          456KB

                        • memory/2388-132-0x0000024C41F10000-0x0000024C41F12000-memory.dmp

                          Filesize

                          8KB

                        • memory/2388-190-0x0000024C421F0000-0x0000024C42262000-memory.dmp

                          Filesize

                          456KB

                        • memory/2388-133-0x0000024C41F10000-0x0000024C41F12000-memory.dmp

                          Filesize

                          8KB

                        • memory/2388-178-0x0000024C41F10000-0x0000024C41F12000-memory.dmp

                          Filesize

                          8KB

                        • memory/2416-131-0x0000013E3E050000-0x0000013E3E052000-memory.dmp

                          Filesize

                          8KB

                        • memory/2416-177-0x0000013E3E050000-0x0000013E3E052000-memory.dmp

                          Filesize

                          8KB

                        • memory/2416-152-0x0000013E3E2C0000-0x0000013E3E332000-memory.dmp

                          Filesize

                          456KB

                        • memory/2416-130-0x0000013E3E050000-0x0000013E3E052000-memory.dmp

                          Filesize

                          8KB

                        • memory/2416-189-0x0000013E3EA00000-0x0000013E3EA72000-memory.dmp

                          Filesize

                          456KB

                        • memory/2584-175-0x00000153949E0000-0x00000153949E2000-memory.dmp

                          Filesize

                          8KB

                        • memory/2584-124-0x00000153949E0000-0x00000153949E2000-memory.dmp

                          Filesize

                          8KB

                        • memory/2584-125-0x00000153949E0000-0x00000153949E2000-memory.dmp

                          Filesize

                          8KB

                        • memory/2584-147-0x0000015395400000-0x0000015395472000-memory.dmp

                          Filesize

                          456KB

                        • memory/2584-187-0x00000153957C0000-0x0000015395832000-memory.dmp

                          Filesize

                          456KB

                        • memory/2724-153-0x0000020A97CF0000-0x0000020A97CF2000-memory.dmp

                          Filesize

                          8KB

                        • memory/2724-185-0x0000020A97CF0000-0x0000020A97CF2000-memory.dmp

                          Filesize

                          8KB

                        • memory/2724-157-0x0000020A99100000-0x0000020A99172000-memory.dmp

                          Filesize

                          456KB

                        • memory/2724-155-0x0000020A97CF0000-0x0000020A97CF2000-memory.dmp

                          Filesize

                          8KB

                        • memory/2724-197-0x0000020A99180000-0x0000020A991F2000-memory.dmp

                          Filesize

                          456KB

                        • memory/2744-186-0x0000014C24430000-0x0000014C24432000-memory.dmp

                          Filesize

                          8KB

                        • memory/2744-158-0x0000014C24430000-0x0000014C24432000-memory.dmp

                          Filesize

                          8KB

                        • memory/2744-162-0x0000014C24CD0000-0x0000014C24D42000-memory.dmp

                          Filesize

                          456KB

                        • memory/2744-160-0x0000014C24430000-0x0000014C24432000-memory.dmp

                          Filesize

                          8KB

                        • memory/2744-198-0x0000014C25240000-0x0000014C252B2000-memory.dmp

                          Filesize

                          456KB

                        • memory/2908-120-0x0000000004FF0000-0x000000000504D000-memory.dmp

                          Filesize

                          372KB

                        • memory/2908-119-0x0000000004E8E000-0x0000000004F8F000-memory.dmp

                          Filesize

                          1.0MB