Resubmissions

27-10-2021 14:44

211027-r4madafbg6 10

27-10-2021 14:28

211027-rs7f6sfah4 10

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • submitted
    01-01-1970 00:00

General

  • Target

    setup_installer/Wed09abf83d9c2.exe

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 18 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
    1⤵
      PID:1248
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
      1⤵
        PID:1924
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s SENS
        1⤵
          PID:1460
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2540
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Browser
            1⤵
            • Modifies registry class
            PID:2672
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s WpnService
            1⤵
              PID:2856
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2840
              • C:\Windows\system32\wbem\WMIADAP.EXE
                wmiadap.exe /F /T /R
                2⤵
                  PID:1112
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                1⤵
                  PID:2688
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1236
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1124
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:444
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:384
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                          1⤵
                          • Suspicious use of SetThreadContext
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1836
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                            • Drops file in System32 directory
                            • Checks processor information in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:1976
                        • C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3536
                          • C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe" -u
                            2⤵
                              PID:1056
                          • C:\Windows\system32\rundll32.exe
                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                            1⤵
                            • Process spawned unexpected child process
                            • Suspicious use of WriteProcessMemory
                            PID:3736
                            • C:\Windows\SysWOW64\rundll32.exe
                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                              2⤵
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3884

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Discovery

                          System Information Discovery

                          2
                          T1082

                          Query Registry

                          1
                          T1012

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
                            MD5

                            f11135e034c7f658c2eb26cb0dee5751

                            SHA1

                            5501048d16e8d5830b0f38d857d2de0f21449b39

                            SHA256

                            0d5f602551f88a1dee285bf30f8ae9718e5c72df538437c8be180e54d0b32ae9

                            SHA512

                            42eab3508b52b0476eb7c09f9b90731f2372432ca249e4505d0f210881c9f58e2aae63f15d5e91d0f87d9730b8f5324b3651cbd37ae292f9aa5f420243a42099

                          • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                            MD5

                            6b27958ef127d7935b5cdb73be763bef

                            SHA1

                            f3fc2190e19426c2d40194d5805982937fca2c95

                            SHA256

                            55298ae1f02d8dcb33a583c5fcf35b650a8283b88d3f015f1c31a17332b9886b

                            SHA512

                            0238ed8d647dede5d45e0f6cd06173f687d04aa6f176aa874373851780fafe58955126fac1ca3900e47cc4cd3c9c6e53dd8a552a11389897b7221f71980659ef

                          • \Users\Admin\AppData\Local\Temp\sqlite.dll
                            MD5

                            6b27958ef127d7935b5cdb73be763bef

                            SHA1

                            f3fc2190e19426c2d40194d5805982937fca2c95

                            SHA256

                            55298ae1f02d8dcb33a583c5fcf35b650a8283b88d3f015f1c31a17332b9886b

                            SHA512

                            0238ed8d647dede5d45e0f6cd06173f687d04aa6f176aa874373851780fafe58955126fac1ca3900e47cc4cd3c9c6e53dd8a552a11389897b7221f71980659ef

                          • memory/384-146-0x00000184A38D0000-0x00000184A3942000-memory.dmp
                            Filesize

                            456KB

                          • memory/384-189-0x00000184A3FB0000-0x00000184A4022000-memory.dmp
                            Filesize

                            456KB

                          • memory/384-129-0x00000184A3030000-0x00000184A3032000-memory.dmp
                            Filesize

                            8KB

                          • memory/384-127-0x00000184A3030000-0x00000184A3032000-memory.dmp
                            Filesize

                            8KB

                          • memory/384-177-0x00000184A3030000-0x00000184A3032000-memory.dmp
                            Filesize

                            8KB

                          • memory/444-181-0x0000021006E70000-0x0000021006E72000-memory.dmp
                            Filesize

                            8KB

                          • memory/444-142-0x0000021007660000-0x00000210076D2000-memory.dmp
                            Filesize

                            456KB

                          • memory/444-138-0x0000021006E70000-0x0000021006E72000-memory.dmp
                            Filesize

                            8KB

                          • memory/444-193-0x0000021007870000-0x00000210078E2000-memory.dmp
                            Filesize

                            456KB

                          • memory/444-140-0x0000021006E70000-0x0000021006E72000-memory.dmp
                            Filesize

                            8KB

                          • memory/1056-115-0x0000000000000000-mapping.dmp
                          • memory/1112-170-0x0000000000000000-mapping.dmp
                          • memory/1124-192-0x000001460A380000-0x000001460A3F2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1124-180-0x00000146097C0000-0x00000146097C2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1124-135-0x00000146097C0000-0x00000146097C2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1124-152-0x0000014609F60000-0x0000014609FD2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1124-134-0x00000146097C0000-0x00000146097C2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1236-154-0x000001F931DA0000-0x000001F931DA2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1236-184-0x000001F931DA0000-0x000001F931DA2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1236-155-0x000001F931DA0000-0x000001F931DA2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1236-162-0x000001F9325D0000-0x000001F932642000-memory.dmp
                            Filesize

                            456KB

                          • memory/1236-196-0x000001F932710000-0x000001F932782000-memory.dmp
                            Filesize

                            456KB

                          • memory/1248-157-0x0000029A3F7F0000-0x0000029A3F7F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1248-185-0x0000029A3F7F0000-0x0000029A3F7F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1248-197-0x0000029A40050000-0x0000029A400C2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1248-156-0x0000029A3F7F0000-0x0000029A3F7F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1248-163-0x0000029A3FFD0000-0x0000029A40042000-memory.dmp
                            Filesize

                            456KB

                          • memory/1460-144-0x00000172A4FE0000-0x00000172A4FE2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1460-194-0x00000172A56F0000-0x00000172A5762000-memory.dmp
                            Filesize

                            456KB

                          • memory/1460-145-0x00000172A4FE0000-0x00000172A4FE2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1460-148-0x00000172A5600000-0x00000172A5672000-memory.dmp
                            Filesize

                            456KB

                          • memory/1460-182-0x00000172A4FE0000-0x00000172A4FE2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1836-122-0x0000026C78EF0000-0x0000026C78EF2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1836-175-0x0000026C78E40000-0x0000026C78E44000-memory.dmp
                            Filesize

                            16KB

                          • memory/1836-121-0x0000026C78EF0000-0x0000026C78EF2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1836-139-0x0000026C79290000-0x0000026C79302000-memory.dmp
                            Filesize

                            456KB

                          • memory/1836-173-0x0000026C78EB0000-0x0000026C78EB4000-memory.dmp
                            Filesize

                            16KB

                          • memory/1836-172-0x0000026C78EB0000-0x0000026C78EB1000-memory.dmp
                            Filesize

                            4KB

                          • memory/1836-171-0x0000026C78F00000-0x0000026C78F04000-memory.dmp
                            Filesize

                            16KB

                          • memory/1836-137-0x0000026C791D0000-0x0000026C7921D000-memory.dmp
                            Filesize

                            308KB

                          • memory/1924-151-0x00000266FCCF0000-0x00000266FCCF2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1924-149-0x00000266FCCF0000-0x00000266FCCF2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1924-153-0x00000266FCE70000-0x00000266FCEE2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1924-195-0x00000266FD4A0000-0x00000266FD512000-memory.dmp
                            Filesize

                            456KB

                          • memory/1924-183-0x00000266FCCF0000-0x00000266FCCF2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1976-143-0x000001EC06130000-0x000001EC061A2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1976-123-0x00007FF6B7274060-mapping.dmp
                          • memory/1976-166-0x000001EC061E0000-0x000001EC061E2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1976-167-0x000001EC061E0000-0x000001EC061E2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1976-168-0x000001EC07AB0000-0x000001EC07ACB000-memory.dmp
                            Filesize

                            108KB

                          • memory/1976-169-0x000001EC08A00000-0x000001EC08B06000-memory.dmp
                            Filesize

                            1.0MB

                          • memory/1976-126-0x000001EC061E0000-0x000001EC061E2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1976-128-0x000001EC061E0000-0x000001EC061E2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2540-179-0x000002BD2E650000-0x000002BD2E652000-memory.dmp
                            Filesize

                            8KB

                          • memory/2540-191-0x000002BD2EED0000-0x000002BD2EF42000-memory.dmp
                            Filesize

                            456KB

                          • memory/2540-132-0x000002BD2E650000-0x000002BD2E652000-memory.dmp
                            Filesize

                            8KB

                          • memory/2540-150-0x000002BD2E800000-0x000002BD2E872000-memory.dmp
                            Filesize

                            456KB

                          • memory/2540-133-0x000002BD2E650000-0x000002BD2E652000-memory.dmp
                            Filesize

                            8KB

                          • memory/2672-125-0x00000144483F0000-0x00000144483F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2672-188-0x0000014449140000-0x00000144491B2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2672-141-0x0000014448660000-0x00000144486D2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2672-124-0x00000144483F0000-0x00000144483F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2672-176-0x00000144483F0000-0x00000144483F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2688-147-0x000001CDEC660000-0x000001CDEC6D2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2688-178-0x000001CDEBEF0000-0x000001CDEBEF2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2688-131-0x000001CDEBEF0000-0x000001CDEBEF2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2688-130-0x000001CDEBEF0000-0x000001CDEBEF2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2688-190-0x000001CDECD40000-0x000001CDECDB2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2840-158-0x0000023A46200000-0x0000023A46202000-memory.dmp
                            Filesize

                            8KB

                          • memory/2840-164-0x0000023A46240000-0x0000023A462B2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2840-198-0x0000023A47140000-0x0000023A471B2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2840-186-0x0000023A46200000-0x0000023A46202000-memory.dmp
                            Filesize

                            8KB

                          • memory/2840-159-0x0000023A46200000-0x0000023A46202000-memory.dmp
                            Filesize

                            8KB

                          • memory/2856-161-0x000001B27B3A0000-0x000001B27B3A2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2856-160-0x000001B27B3A0000-0x000001B27B3A2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2856-165-0x000001B27BA10000-0x000001B27BA82000-memory.dmp
                            Filesize

                            456KB

                          • memory/2856-187-0x000001B27B3A0000-0x000001B27B3A2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2856-199-0x000001B27B3A0000-0x000001B27B3CB000-memory.dmp
                            Filesize

                            172KB

                          • memory/2856-200-0x000001B27BA90000-0x000001B27BB02000-memory.dmp
                            Filesize

                            456KB

                          • memory/3884-136-0x0000000004D90000-0x0000000004DED000-memory.dmp
                            Filesize

                            372KB

                          • memory/3884-120-0x0000000004FFF000-0x0000000005100000-memory.dmp
                            Filesize

                            1.0MB

                          • memory/3884-117-0x0000000000000000-mapping.dmp