Resubmissions

27-10-2021 14:44

211027-r4madafbg6 10

27-10-2021 14:28

211027-rs7f6sfah4 10

Analysis

  • max time kernel
    1794s
  • max time network
    1564s
  • submitted
    01-01-1970 00:00

General

  • Target

    setup_installer/Wed09abf83d9c2.exe

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 20 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
    • Modifies registry class
    PID:1004
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
      PID:1032
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
      1⤵
        PID:1116
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Themes
        1⤵
          PID:1200
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s UserManager
          1⤵
            PID:1372
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
            • Modifies registry class
            PID:1408
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s WpnService
            1⤵
              PID:2704
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2668
              • C:\Windows\system32\wbem\WMIADAP.EXE
                wmiadap.exe /F /T /R
                2⤵
                  PID:776
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Browser
                1⤵
                  PID:2572
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                  1⤵
                    PID:2412
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                    1⤵
                      PID:2380
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                      1⤵
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4628
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                        • Drops file in System32 directory
                        • Checks processor information in registry
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:2492
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                      1⤵
                        PID:1916
                      • C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe
                        "C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1804
                        • C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe" -u
                          2⤵
                            PID:4072
                        • C:\Windows\system32\rundll32.exe
                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                          1⤵
                          • Process spawned unexpected child process
                          • Suspicious use of WriteProcessMemory
                          PID:4404
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                            2⤵
                            • Loads dropped DLL
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2172

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Discovery

                        System Information Discovery

                        2
                        T1082

                        Query Registry

                        1
                        T1012

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
                          MD5

                          f11135e034c7f658c2eb26cb0dee5751

                          SHA1

                          5501048d16e8d5830b0f38d857d2de0f21449b39

                          SHA256

                          0d5f602551f88a1dee285bf30f8ae9718e5c72df538437c8be180e54d0b32ae9

                          SHA512

                          42eab3508b52b0476eb7c09f9b90731f2372432ca249e4505d0f210881c9f58e2aae63f15d5e91d0f87d9730b8f5324b3651cbd37ae292f9aa5f420243a42099

                        • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                          MD5

                          6b27958ef127d7935b5cdb73be763bef

                          SHA1

                          f3fc2190e19426c2d40194d5805982937fca2c95

                          SHA256

                          55298ae1f02d8dcb33a583c5fcf35b650a8283b88d3f015f1c31a17332b9886b

                          SHA512

                          0238ed8d647dede5d45e0f6cd06173f687d04aa6f176aa874373851780fafe58955126fac1ca3900e47cc4cd3c9c6e53dd8a552a11389897b7221f71980659ef

                        • \Users\Admin\AppData\Local\Temp\sqlite.dll
                          MD5

                          6b27958ef127d7935b5cdb73be763bef

                          SHA1

                          f3fc2190e19426c2d40194d5805982937fca2c95

                          SHA256

                          55298ae1f02d8dcb33a583c5fcf35b650a8283b88d3f015f1c31a17332b9886b

                          SHA512

                          0238ed8d647dede5d45e0f6cd06173f687d04aa6f176aa874373851780fafe58955126fac1ca3900e47cc4cd3c9c6e53dd8a552a11389897b7221f71980659ef

                        • memory/776-170-0x0000000000000000-mapping.dmp
                        • memory/1004-189-0x000001954A140000-0x000001954A1B2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1004-152-0x0000019549A90000-0x0000019549B02000-memory.dmp
                          Filesize

                          456KB

                        • memory/1004-129-0x00000195495A0000-0x00000195495A2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1004-128-0x00000195495A0000-0x00000195495A2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1004-177-0x00000195495A0000-0x00000195495A2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1032-136-0x000001BC2B750000-0x000001BC2B752000-memory.dmp
                          Filesize

                          8KB

                        • memory/1032-160-0x000001BC2C170000-0x000001BC2C1E2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1032-193-0x000001BC2C1F0000-0x000001BC2C262000-memory.dmp
                          Filesize

                          456KB

                        • memory/1032-204-0x000001BC2B750000-0x000001BC2B752000-memory.dmp
                          Filesize

                          8KB

                        • memory/1032-181-0x000001BC2B750000-0x000001BC2B752000-memory.dmp
                          Filesize

                          8KB

                        • memory/1032-216-0x000001BC2C740000-0x000001BC2C7B2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1032-137-0x000001BC2B750000-0x000001BC2B752000-memory.dmp
                          Filesize

                          8KB

                        • memory/1116-135-0x000001EFC8860000-0x000001EFC8862000-memory.dmp
                          Filesize

                          8KB

                        • memory/1116-159-0x000001EFC9640000-0x000001EFC96B2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1116-180-0x000001EFC8860000-0x000001EFC8862000-memory.dmp
                          Filesize

                          8KB

                        • memory/1116-134-0x000001EFC8860000-0x000001EFC8862000-memory.dmp
                          Filesize

                          8KB

                        • memory/1116-215-0x000001EFC97B0000-0x000001EFC9822000-memory.dmp
                          Filesize

                          456KB

                        • memory/1116-192-0x000001EFC96C0000-0x000001EFC9732000-memory.dmp
                          Filesize

                          456KB

                        • memory/1116-203-0x000001EFC8860000-0x000001EFC8862000-memory.dmp
                          Filesize

                          8KB

                        • memory/1200-207-0x000002A116EC0000-0x000002A116EC2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1200-148-0x000002A117710000-0x000002A117782000-memory.dmp
                          Filesize

                          456KB

                        • memory/1200-184-0x000002A116EC0000-0x000002A116EC2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1200-196-0x000002A117CB0000-0x000002A117D22000-memory.dmp
                          Filesize

                          456KB

                        • memory/1200-219-0x000002A117DA0000-0x000002A117E12000-memory.dmp
                          Filesize

                          456KB

                        • memory/1200-145-0x000002A116EC0000-0x000002A116EC2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1200-142-0x000002A116EC0000-0x000002A116EC2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1372-149-0x000001FE893C0000-0x000001FE893C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1372-153-0x000001FE89C40000-0x000001FE89CB2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1372-185-0x000001FE893C0000-0x000001FE893C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1372-220-0x000001FE8A230000-0x000001FE8A2A2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1372-208-0x000001FE893C0000-0x000001FE893C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1372-150-0x000001FE893C0000-0x000001FE893C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1372-197-0x000001FE8A140000-0x000001FE8A1B2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1408-194-0x000002154BF10000-0x000002154BF82000-memory.dmp
                          Filesize

                          456KB

                        • memory/1408-182-0x000002154B5D0000-0x000002154B5D2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1408-138-0x000002154B5D0000-0x000002154B5D2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1408-205-0x000002154B5D0000-0x000002154B5D2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1408-139-0x000002154B5D0000-0x000002154B5D2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1408-217-0x000002154C540000-0x000002154C5B2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1408-163-0x000002154BDD0000-0x000002154BE42000-memory.dmp
                          Filesize

                          456KB

                        • memory/1916-141-0x00000185B80E0000-0x00000185B80E2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1916-140-0x00000185B80E0000-0x00000185B80E2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1916-164-0x00000185B8170000-0x00000185B81E2000-memory.dmp
                          Filesize

                          456KB

                        • memory/1916-183-0x00000185B80E0000-0x00000185B80E2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1916-195-0x00000185B8BB0000-0x00000185B8C22000-memory.dmp
                          Filesize

                          456KB

                        • memory/1916-206-0x00000185B80E0000-0x00000185B80E2000-memory.dmp
                          Filesize

                          8KB

                        • memory/1916-218-0x00000185B8C30000-0x00000185B8CA2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2172-120-0x000000000129D000-0x000000000139E000-memory.dmp
                          Filesize

                          1.0MB

                        • memory/2172-143-0x0000000004980000-0x00000000049DD000-memory.dmp
                          Filesize

                          372KB

                        • memory/2172-117-0x0000000000000000-mapping.dmp
                        • memory/2380-132-0x0000019F61AF0000-0x0000019F61AF2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2380-156-0x0000019F61C70000-0x0000019F61CE2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2380-214-0x0000019F62320000-0x0000019F62392000-memory.dmp
                          Filesize

                          456KB

                        • memory/2380-202-0x0000019F61AF0000-0x0000019F61AF2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2380-133-0x0000019F61AF0000-0x0000019F61AF2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2380-179-0x0000019F61AF0000-0x0000019F61AF2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2380-191-0x0000019F622A0000-0x0000019F62312000-memory.dmp
                          Filesize

                          456KB

                        • memory/2412-131-0x000001EB4FCC0000-0x000001EB4FCC2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2412-178-0x000001EB4FCC0000-0x000001EB4FCC2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2412-154-0x000001EB505C0000-0x000001EB50632000-memory.dmp
                          Filesize

                          456KB

                        • memory/2412-201-0x000001EB4FCC0000-0x000001EB4FCC2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2412-130-0x000001EB4FCC0000-0x000001EB4FCC2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2412-212-0x000001EB50C30000-0x000001EB50CA2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2412-190-0x000001EB50B40000-0x000001EB50BB2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2492-167-0x000001A701DF0000-0x000001A701DF2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2492-151-0x000001A701D40000-0x000001A701DB2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2492-127-0x000001A701DF0000-0x000001A701DF2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2492-126-0x000001A701DF0000-0x000001A701DF2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2492-123-0x00007FF73E464060-mapping.dmp
                        • memory/2492-169-0x000001A704600000-0x000001A704706000-memory.dmp
                          Filesize

                          1.0MB

                        • memory/2492-168-0x000001A7036C0000-0x000001A7036DB000-memory.dmp
                          Filesize

                          108KB

                        • memory/2492-166-0x000001A701DF0000-0x000001A701DF2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2572-188-0x0000020862CB0000-0x0000020862D22000-memory.dmp
                          Filesize

                          456KB

                        • memory/2572-124-0x00000208621C0000-0x00000208621C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2572-210-0x0000020862D30000-0x0000020862DA2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2572-125-0x00000208621C0000-0x00000208621C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2572-176-0x00000208621C0000-0x00000208621C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2572-147-0x0000020862140000-0x00000208621B2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2572-200-0x00000208621C0000-0x00000208621C2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2668-209-0x0000027E9CCE0000-0x0000027E9CCE2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2668-158-0x0000027E9D4A0000-0x0000027E9D512000-memory.dmp
                          Filesize

                          456KB

                        • memory/2668-198-0x0000027E9D640000-0x0000027E9D6B2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2668-155-0x0000027E9CCE0000-0x0000027E9CCE2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2668-157-0x0000027E9CCE0000-0x0000027E9CCE2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2668-186-0x0000027E9CCE0000-0x0000027E9CCE2000-memory.dmp
                          Filesize

                          8KB

                        • memory/2668-221-0x0000027E9DE40000-0x0000027E9DEB2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2704-162-0x00000207F8600000-0x00000207F8602000-memory.dmp
                          Filesize

                          8KB

                        • memory/2704-161-0x00000207F8600000-0x00000207F8602000-memory.dmp
                          Filesize

                          8KB

                        • memory/2704-165-0x00000207F8C60000-0x00000207F8CD2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2704-199-0x00000207F9240000-0x00000207F92B2000-memory.dmp
                          Filesize

                          456KB

                        • memory/2704-187-0x00000207F8600000-0x00000207F8602000-memory.dmp
                          Filesize

                          8KB

                        • memory/2704-211-0x00000207F8600000-0x00000207F8602000-memory.dmp
                          Filesize

                          8KB

                        • memory/2704-213-0x00000207F92C0000-0x00000207F9332000-memory.dmp
                          Filesize

                          456KB

                        • memory/4072-115-0x0000000000000000-mapping.dmp
                        • memory/4628-175-0x0000024544500000-0x0000024544504000-memory.dmp
                          Filesize

                          16KB

                        • memory/4628-121-0x0000024544580000-0x0000024544582000-memory.dmp
                          Filesize

                          8KB

                        • memory/4628-171-0x0000024544600000-0x0000024544604000-memory.dmp
                          Filesize

                          16KB

                        • memory/4628-122-0x0000024544580000-0x0000024544582000-memory.dmp
                          Filesize

                          8KB

                        • memory/4628-172-0x00000245445F0000-0x00000245445F1000-memory.dmp
                          Filesize

                          4KB

                        • memory/4628-146-0x0000024544920000-0x0000024544992000-memory.dmp
                          Filesize

                          456KB

                        • memory/4628-173-0x00000245445F0000-0x00000245445F4000-memory.dmp
                          Filesize

                          16KB

                        • memory/4628-144-0x00000245445A0000-0x00000245445ED000-memory.dmp
                          Filesize

                          308KB