Analysis
-
max time kernel
129s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 18:02
Static task
static1
Behavioral task
behavioral1
Sample
ea785ebe3cb6409d9fed610f8c21f967.exe
Resource
win7-en-20211014
General
-
Target
ea785ebe3cb6409d9fed610f8c21f967.exe
-
Size
57KB
-
MD5
ea785ebe3cb6409d9fed610f8c21f967
-
SHA1
e76264063483ead9d65cfe31ba12282b7d95edba
-
SHA256
d03c843490124f40cf12e9cf9ceb3435d564b4b58ad6eecc04046476dc27d29a
-
SHA512
1adfd2246fd3f6749cce3348a12558594ab693c1d40e6cfbf1f3f42c855a89518bc2750958d28d8d43b4df28213d6f6e8ff34638a8f2e805b9e550ce86300daf
Malware Config
Signatures
-
Nirsoft 7 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exe Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 1556 AdvancedRun.exe 1164 AdvancedRun.exe -
Loads dropped DLL 4 IoCs
Processes:
ea785ebe3cb6409d9fed610f8c21f967.exeAdvancedRun.exepid process 1716 ea785ebe3cb6409d9fed610f8c21f967.exe 1716 ea785ebe3cb6409d9fed610f8c21f967.exe 1556 AdvancedRun.exe 1556 AdvancedRun.exe -
Processes:
ea785ebe3cb6409d9fed610f8c21f967.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection ea785ebe3cb6409d9fed610f8c21f967.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" ea785ebe3cb6409d9fed610f8c21f967.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features ea785ebe3cb6409d9fed610f8c21f967.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" ea785ebe3cb6409d9fed610f8c21f967.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions ea785ebe3cb6409d9fed610f8c21f967.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\玁獹獎玃獍獨獎獽獇獈獻獎獍獛獼\svchost.exe = "0" ea785ebe3cb6409d9fed610f8c21f967.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe = "0" ea785ebe3cb6409d9fed610f8c21f967.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" ea785ebe3cb6409d9fed610f8c21f967.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths ea785ebe3cb6409d9fed610f8c21f967.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ea785ebe3cb6409d9fed610f8c21f967.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\㎏㎒㍖㍹㎏㎎㎙㍖㍑㎏㎈㎔㍒㎆㎆ = "C:\\Users\\Public\\Documents\\玁獹獎玃獍獨獎獽獇獈獻獎獍獛獼\\svchost.exe" ea785ebe3cb6409d9fed610f8c21f967.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 944 1716 WerFault.exe ea785ebe3cb6409d9fed610f8c21f967.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exepowershell.exeWerFault.exepid process 1556 AdvancedRun.exe 1556 AdvancedRun.exe 1164 AdvancedRun.exe 1164 AdvancedRun.exe 2016 powershell.exe 1380 powershell.exe 688 powershell.exe 1860 powershell.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe 944 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 944 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
ea785ebe3cb6409d9fed610f8c21f967.exeAdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exepowershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1716 ea785ebe3cb6409d9fed610f8c21f967.exe Token: SeDebugPrivilege 1556 AdvancedRun.exe Token: SeImpersonatePrivilege 1556 AdvancedRun.exe Token: SeDebugPrivilege 1164 AdvancedRun.exe Token: SeImpersonatePrivilege 1164 AdvancedRun.exe Token: SeDebugPrivilege 2016 powershell.exe Token: SeDebugPrivilege 1860 powershell.exe Token: SeDebugPrivilege 688 powershell.exe Token: SeDebugPrivilege 1380 powershell.exe Token: SeDebugPrivilege 944 WerFault.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
ea785ebe3cb6409d9fed610f8c21f967.exeAdvancedRun.exedescription pid process target process PID 1716 wrote to memory of 688 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 688 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 688 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 688 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 1380 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 1380 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 1380 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 1380 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 1860 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 1860 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 1860 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 1860 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 1556 1716 ea785ebe3cb6409d9fed610f8c21f967.exe AdvancedRun.exe PID 1716 wrote to memory of 1556 1716 ea785ebe3cb6409d9fed610f8c21f967.exe AdvancedRun.exe PID 1716 wrote to memory of 1556 1716 ea785ebe3cb6409d9fed610f8c21f967.exe AdvancedRun.exe PID 1716 wrote to memory of 1556 1716 ea785ebe3cb6409d9fed610f8c21f967.exe AdvancedRun.exe PID 1556 wrote to memory of 1164 1556 AdvancedRun.exe AdvancedRun.exe PID 1556 wrote to memory of 1164 1556 AdvancedRun.exe AdvancedRun.exe PID 1556 wrote to memory of 1164 1556 AdvancedRun.exe AdvancedRun.exe PID 1556 wrote to memory of 1164 1556 AdvancedRun.exe AdvancedRun.exe PID 1716 wrote to memory of 2016 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 2016 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 2016 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 2016 1716 ea785ebe3cb6409d9fed610f8c21f967.exe powershell.exe PID 1716 wrote to memory of 984 1716 ea785ebe3cb6409d9fed610f8c21f967.exe ea785ebe3cb6409d9fed610f8c21f967.exe PID 1716 wrote to memory of 984 1716 ea785ebe3cb6409d9fed610f8c21f967.exe ea785ebe3cb6409d9fed610f8c21f967.exe PID 1716 wrote to memory of 984 1716 ea785ebe3cb6409d9fed610f8c21f967.exe ea785ebe3cb6409d9fed610f8c21f967.exe PID 1716 wrote to memory of 984 1716 ea785ebe3cb6409d9fed610f8c21f967.exe ea785ebe3cb6409d9fed610f8c21f967.exe PID 1716 wrote to memory of 944 1716 ea785ebe3cb6409d9fed610f8c21f967.exe WerFault.exe PID 1716 wrote to memory of 944 1716 ea785ebe3cb6409d9fed610f8c21f967.exe WerFault.exe PID 1716 wrote to memory of 944 1716 ea785ebe3cb6409d9fed610f8c21f967.exe WerFault.exe PID 1716 wrote to memory of 944 1716 ea785ebe3cb6409d9fed610f8c21f967.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe"C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe"1⤵
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\玁獹獎玃獍獨獎獽獇獈獻獎獍獛獼\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\玁獹獎玃獍獨獎獽獇獈獻獎獍獛獼\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exe" /SpecialRun 4101d8 15563⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exeC:\Users\Admin\AppData\Local\Temp\ea785ebe3cb6409d9fed610f8c21f967.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 19722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
cb8ed860997574d12c1efa811d56999e
SHA184dabac3b1ef7949b15d07383e75661e5f852551
SHA2564d69a25af4bcda73cd5c5b00b1b8b60ef5f54a144aceac45bdd476c9c5adc131
SHA51222103405b58f480e5a2d1f7c937ac25c4c747cff95977abf6ecd5f196c2a732a00dc9bb3bad5065c853c9c3a9172414a8d76c0531c34db0203885ba079b8f6a2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
cb8ed860997574d12c1efa811d56999e
SHA184dabac3b1ef7949b15d07383e75661e5f852551
SHA2564d69a25af4bcda73cd5c5b00b1b8b60ef5f54a144aceac45bdd476c9c5adc131
SHA51222103405b58f480e5a2d1f7c937ac25c4c747cff95977abf6ecd5f196c2a732a00dc9bb3bad5065c853c9c3a9172414a8d76c0531c34db0203885ba079b8f6a2
-
\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\34c5be3d-7d91-444d-9de3-e90f066856ce\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/688-60-0x0000000000000000-mapping.dmp
-
memory/688-78-0x0000000002380000-0x0000000002FCA000-memory.dmpFilesize
12.3MB
-
memory/944-89-0x00000000006E0000-0x00000000006F4000-memory.dmpFilesize
80KB
-
memory/944-88-0x0000000000000000-mapping.dmp
-
memory/1164-75-0x0000000000000000-mapping.dmp
-
memory/1380-79-0x0000000002380000-0x0000000002FCA000-memory.dmpFilesize
12.3MB
-
memory/1380-62-0x0000000000000000-mapping.dmp
-
memory/1556-69-0x0000000000000000-mapping.dmp
-
memory/1716-57-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB
-
memory/1716-58-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/1716-55-0x0000000000FE0000-0x0000000000FE1000-memory.dmpFilesize
4KB
-
memory/1716-59-0x0000000005150000-0x00000000051B6000-memory.dmpFilesize
408KB
-
memory/1860-80-0x00000000023A0000-0x0000000002FEA000-memory.dmpFilesize
12.3MB
-
memory/1860-84-0x00000000023A0000-0x0000000002FEA000-memory.dmpFilesize
12.3MB
-
memory/1860-63-0x0000000000000000-mapping.dmp
-
memory/2016-81-0x0000000000000000-mapping.dmp
-
memory/2016-85-0x0000000002351000-0x0000000002352000-memory.dmpFilesize
4KB
-
memory/2016-86-0x0000000002352000-0x0000000002354000-memory.dmpFilesize
8KB
-
memory/2016-87-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB