Analysis
-
max time kernel
147s -
max time network
174s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
25-10-2021 23:26
Static task
static1
Behavioral task
behavioral1
Sample
F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe
Resource
win7-en-20210920
General
-
Target
F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe
-
Size
295KB
-
MD5
33ae78ba3dd28456aeb110525cfa1b4c
-
SHA1
cea136aaf614cdf028f23534c89609393f05b158
-
SHA256
f3c6ec081b07206679c92b3ce2066fe2db39e8977c650bf126cfd390637ae651
-
SHA512
dcd9da59e091d9df63e53e8dd672f0c51674a69effec7f8b41202d84fc968e153f65578db6eee266bea52f9af3d18d5dd8823dc264b6ff61d9a7020356eb7ffe
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe -
suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4
suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4
-
Sets file execution options in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Loads dropped DLL 1 IoCs
Processes:
F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exepid process 1328 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe up = "\"C:\\ProgramData\\adobeup\\5w9u9s3m15e7.exe\"" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Adobe up = "C:\\ProgramData\\adobeup\\5w9u9s3m15e7.exe" explorer.exe -
Processes:
F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exeexplorer.exepid process 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exedescription pid process target process PID 1328 set thread context of 1300 1328 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
explorer.exeF3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main explorer.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
explorer.exepid process 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exeF3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exeexplorer.exepid process 1328 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe 1972 explorer.exe 1972 explorer.exe 1972 explorer.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exepid process 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeRestorePrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeBackupPrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeLoadDriverPrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeCreatePagefilePrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeShutdownPrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeTakeOwnershipPrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeChangeNotifyPrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeCreateTokenPrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeMachineAccountPrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeSecurityPrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeAssignPrimaryTokenPrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeCreateGlobalPrivilege 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: 33 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe Token: SeDebugPrivilege 1972 explorer.exe Token: SeRestorePrivilege 1972 explorer.exe Token: SeBackupPrivilege 1972 explorer.exe Token: SeLoadDriverPrivilege 1972 explorer.exe Token: SeCreatePagefilePrivilege 1972 explorer.exe Token: SeShutdownPrivilege 1972 explorer.exe Token: SeTakeOwnershipPrivilege 1972 explorer.exe Token: SeChangeNotifyPrivilege 1972 explorer.exe Token: SeCreateTokenPrivilege 1972 explorer.exe Token: SeMachineAccountPrivilege 1972 explorer.exe Token: SeSecurityPrivilege 1972 explorer.exe Token: SeAssignPrimaryTokenPrivilege 1972 explorer.exe Token: SeCreateGlobalPrivilege 1972 explorer.exe Token: 33 1972 explorer.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exeF3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exeexplorer.exedescription pid process target process PID 1328 wrote to memory of 1300 1328 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe PID 1328 wrote to memory of 1300 1328 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe PID 1328 wrote to memory of 1300 1328 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe PID 1328 wrote to memory of 1300 1328 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe PID 1328 wrote to memory of 1300 1328 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe PID 1300 wrote to memory of 1972 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe explorer.exe PID 1300 wrote to memory of 1972 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe explorer.exe PID 1300 wrote to memory of 1972 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe explorer.exe PID 1300 wrote to memory of 1972 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe explorer.exe PID 1300 wrote to memory of 1972 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe explorer.exe PID 1300 wrote to memory of 1972 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe explorer.exe PID 1300 wrote to memory of 1972 1300 F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe explorer.exe PID 1972 wrote to memory of 1344 1972 explorer.exe Dwm.exe PID 1972 wrote to memory of 1344 1972 explorer.exe Dwm.exe PID 1972 wrote to memory of 1344 1972 explorer.exe Dwm.exe PID 1972 wrote to memory of 1344 1972 explorer.exe Dwm.exe PID 1972 wrote to memory of 1344 1972 explorer.exe Dwm.exe PID 1972 wrote to memory of 1344 1972 explorer.exe Dwm.exe PID 1972 wrote to memory of 1408 1972 explorer.exe Explorer.EXE PID 1972 wrote to memory of 1408 1972 explorer.exe Explorer.EXE PID 1972 wrote to memory of 1408 1972 explorer.exe Explorer.EXE PID 1972 wrote to memory of 1408 1972 explorer.exe Explorer.EXE PID 1972 wrote to memory of 1408 1972 explorer.exe Explorer.EXE PID 1972 wrote to memory of 1408 1972 explorer.exe Explorer.EXE PID 1972 wrote to memory of 1672 1972 explorer.exe DllHost.exe PID 1972 wrote to memory of 1672 1972 explorer.exe DllHost.exe PID 1972 wrote to memory of 1672 1972 explorer.exe DllHost.exe PID 1972 wrote to memory of 1672 1972 explorer.exe DllHost.exe PID 1972 wrote to memory of 1672 1972 explorer.exe DllHost.exe PID 1972 wrote to memory of 1672 1972 explorer.exe DllHost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe"C:\Users\Admin\AppData\Local\Temp\F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe"C:\Users\Admin\AppData\Local\Temp\F3C6EC081B07206679C92B3CE2066FE2DB39E8977C650.exe"3⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsd319C.tmp\System.dllMD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA256fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
SHA5120a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
-
memory/1300-66-0x00000000006B0000-0x00000000006BC000-memory.dmpFilesize
48KB
-
memory/1300-73-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/1300-65-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB
-
memory/1300-59-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1300-60-0x0000000000240000-0x00000000002A6000-memory.dmpFilesize
408KB
-
memory/1300-61-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1300-62-0x0000000000340000-0x000000000034D000-memory.dmpFilesize
52KB
-
memory/1300-63-0x0000000000240000-0x00000000002A6000-memory.dmpFilesize
408KB
-
memory/1300-58-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1300-56-0x00000000004015C6-mapping.dmp
-
memory/1328-54-0x00000000765A1000-0x00000000765A3000-memory.dmpFilesize
8KB
-
memory/1408-75-0x0000000002AF0000-0x0000000002AF6000-memory.dmpFilesize
24KB
-
memory/1672-76-0x00000000000A0000-0x00000000000A6000-memory.dmpFilesize
24KB
-
memory/1972-71-0x0000000000090000-0x0000000000143000-memory.dmpFilesize
716KB
-
memory/1972-72-0x00000000003D0000-0x00000000003DC000-memory.dmpFilesize
48KB
-
memory/1972-70-0x0000000077DC0000-0x0000000077F40000-memory.dmpFilesize
1.5MB
-
memory/1972-74-0x0000000000440000-0x0000000000442000-memory.dmpFilesize
8KB
-
memory/1972-67-0x0000000000000000-mapping.dmp
-
memory/1972-69-0x0000000075321000-0x0000000075323000-memory.dmpFilesize
8KB