Analysis

  • max time kernel
    167s
  • max time network
    181s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    10-11-2021 15:02

General

  • Target

    d097ca2583425f648592138b57562334c0b83d3179634fd43a0b611bdf720122.exe

  • Size

    89KB

  • MD5

    dc534760d1110201433d670e90ac2ed2

  • SHA1

    4ece22c0a4bde2a2f2936d87d9d6acb5668c3c78

  • SHA256

    d097ca2583425f648592138b57562334c0b83d3179634fd43a0b611bdf720122

  • SHA512

    e9889d072e9cb89201d5a64c7b507066f3edd8e4cf5cc56dea82677f69fb00fff5f1fe627ac9612e9bbd2d864afc91251313e32a403462f1fc572121240e3f99

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 18 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s BITS
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k SystemNetworkService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4256
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2696
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
        PID:2684
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2576
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2368
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2356
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1856
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1496
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1288
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                    1⤵
                      PID:1240
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                      • Modifies registry class
                      PID:1080
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:916
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:1004
                        • C:\Users\Admin\AppData\Local\Temp\d097ca2583425f648592138b57562334c0b83d3179634fd43a0b611bdf720122.exe
                          "C:\Users\Admin\AppData\Local\Temp\d097ca2583425f648592138b57562334c0b83d3179634fd43a0b611bdf720122.exe"
                          1⤵
                            PID:3924
                          • C:\Windows\system32\rundll32.exe
                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                            1⤵
                            • Process spawned unexpected child process
                            • Suspicious use of WriteProcessMemory
                            PID:4488
                            • C:\Windows\SysWOW64\rundll32.exe
                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                              2⤵
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3916

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Discovery

                          System Information Discovery

                          2
                          T1082

                          Query Registry

                          1
                          T1012

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
                            MD5

                            3f2e52bab572f3ba21f8e0f9a8fafbe4

                            SHA1

                            0e88867d28cfaccb0c08acd7ac278de4f535c6b9

                            SHA256

                            587da47d932c227750ce4ac216b3d876ac03faeb943a07da02bbdc541626668a

                            SHA512

                            e282393cf251a9d904e5ab0ee0f52c47cb61c5c821020791571faaf199b40b82ad743ba951bffac8ee3783b54fadc7968e92a8020c01dadb766d0d29ade3b351

                          • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                            MD5

                            d2c3e38d64273ea56d503bb3fb2a8b5d

                            SHA1

                            177da7d99381bbc83ede6b50357f53944240d862

                            SHA256

                            25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                            SHA512

                            2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                          • \Users\Admin\AppData\Local\Temp\sqlite.dll
                            MD5

                            d2c3e38d64273ea56d503bb3fb2a8b5d

                            SHA1

                            177da7d99381bbc83ede6b50357f53944240d862

                            SHA256

                            25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                            SHA512

                            2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                          • memory/916-137-0x000001FDB6260000-0x000001FDB6262000-memory.dmp
                            Filesize

                            8KB

                          • memory/916-190-0x000001FDB7140000-0x000001FDB71B2000-memory.dmp
                            Filesize

                            456KB

                          • memory/916-178-0x000001FDB6260000-0x000001FDB6262000-memory.dmp
                            Filesize

                            8KB

                          • memory/916-138-0x000001FDB6260000-0x000001FDB6262000-memory.dmp
                            Filesize

                            8KB

                          • memory/916-155-0x000001FDB6B40000-0x000001FDB6BB2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1004-151-0x000001FEB3B60000-0x000001FEB3BD2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1004-186-0x000001FEB4270000-0x000001FEB42E2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1004-174-0x000001FEB3B00000-0x000001FEB3B02000-memory.dmp
                            Filesize

                            8KB

                          • memory/1004-129-0x000001FEB3B00000-0x000001FEB3B02000-memory.dmp
                            Filesize

                            8KB

                          • memory/1004-130-0x000001FEB3B00000-0x000001FEB3B02000-memory.dmp
                            Filesize

                            8KB

                          • memory/1080-177-0x0000024A501F0000-0x0000024A501F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1080-189-0x0000024A51160000-0x0000024A511D2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1080-154-0x0000024A51070000-0x0000024A510E2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1080-136-0x0000024A501F0000-0x0000024A501F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1080-135-0x0000024A501F0000-0x0000024A501F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1240-165-0x0000026758230000-0x00000267582A2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1240-182-0x00000267581F0000-0x00000267581F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1240-160-0x00000267581F0000-0x00000267581F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1240-159-0x00000267581F0000-0x00000267581F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1240-194-0x0000026758CB0000-0x0000026758D22000-memory.dmp
                            Filesize

                            456KB

                          • memory/1288-158-0x000001D9D1240000-0x000001D9D12B2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1288-193-0x000001D9D12C0000-0x000001D9D1332000-memory.dmp
                            Filesize

                            456KB

                          • memory/1288-181-0x000001D9D09E0000-0x000001D9D09E2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1288-143-0x000001D9D09E0000-0x000001D9D09E2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1288-144-0x000001D9D09E0000-0x000001D9D09E2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1496-179-0x00000181D7DB0000-0x00000181D7DB2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1496-156-0x00000181D8660000-0x00000181D86D2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1496-140-0x00000181D7DB0000-0x00000181D7DB2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1496-191-0x00000181D8CB0000-0x00000181D8D22000-memory.dmp
                            Filesize

                            456KB

                          • memory/1496-139-0x00000181D7DB0000-0x00000181D7DB2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1856-141-0x00000122D57B0000-0x00000122D57B2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1856-180-0x00000122D57B0000-0x00000122D57B2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1856-142-0x00000122D57B0000-0x00000122D57B2000-memory.dmp
                            Filesize

                            8KB

                          • memory/1856-157-0x00000122D6340000-0x00000122D63B2000-memory.dmp
                            Filesize

                            456KB

                          • memory/1856-192-0x00000122D6430000-0x00000122D64A2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2356-188-0x000001E8A7E40000-0x000001E8A7EB2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2356-134-0x000001E8A7910000-0x000001E8A7912000-memory.dmp
                            Filesize

                            8KB

                          • memory/2356-153-0x000001E8A7890000-0x000001E8A7902000-memory.dmp
                            Filesize

                            456KB

                          • memory/2356-176-0x000001E8A7910000-0x000001E8A7912000-memory.dmp
                            Filesize

                            8KB

                          • memory/2356-133-0x000001E8A7910000-0x000001E8A7912000-memory.dmp
                            Filesize

                            8KB

                          • memory/2368-175-0x0000024F08680000-0x0000024F08682000-memory.dmp
                            Filesize

                            8KB

                          • memory/2368-132-0x0000024F08680000-0x0000024F08682000-memory.dmp
                            Filesize

                            8KB

                          • memory/2368-131-0x0000024F08680000-0x0000024F08682000-memory.dmp
                            Filesize

                            8KB

                          • memory/2368-152-0x0000024F08960000-0x0000024F089D2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2368-187-0x0000024F08EA0000-0x0000024F08F12000-memory.dmp
                            Filesize

                            456KB

                          • memory/2576-173-0x000001A7B35C0000-0x000001A7B35C2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2576-149-0x000001A7B3E80000-0x000001A7B3EF2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2576-125-0x000001A7B35C0000-0x000001A7B35C2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2576-185-0x000001A7B4340000-0x000001A7B43B2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2576-126-0x000001A7B35C0000-0x000001A7B35C2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2684-161-0x0000028A4BFF0000-0x0000028A4BFF2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2684-162-0x0000028A4BFF0000-0x0000028A4BFF2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2684-183-0x0000028A4BFF0000-0x0000028A4BFF2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2684-166-0x0000028A4CF40000-0x0000028A4CFB2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2684-195-0x0000028A4D530000-0x0000028A4D5A2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2696-184-0x000002185C3F0000-0x000002185C3F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2696-167-0x000002185CB60000-0x000002185CBD2000-memory.dmp
                            Filesize

                            456KB

                          • memory/2696-163-0x000002185C3F0000-0x000002185C3F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/2696-196-0x000002185D0B0000-0x000002185D122000-memory.dmp
                            Filesize

                            456KB

                          • memory/2696-164-0x000002185C3F0000-0x000002185C3F2000-memory.dmp
                            Filesize

                            8KB

                          • memory/3916-119-0x0000000000000000-mapping.dmp
                          • memory/3916-146-0x0000000000EE0000-0x0000000000F3D000-memory.dmp
                            Filesize

                            372KB

                          • memory/3916-145-0x0000000004512000-0x0000000004613000-memory.dmp
                            Filesize

                            1.0MB

                          • memory/4256-198-0x00000263CECC0000-0x00000263CECC2000-memory.dmp
                            Filesize

                            8KB

                          • memory/4256-150-0x00000263CEED0000-0x00000263CEF42000-memory.dmp
                            Filesize

                            456KB

                          • memory/4256-200-0x00000263D1500000-0x00000263D1605000-memory.dmp
                            Filesize

                            1.0MB

                          • memory/4256-199-0x00000263D06F0000-0x00000263D070B000-memory.dmp
                            Filesize

                            108KB

                          • memory/4256-197-0x00000263CECC0000-0x00000263CECC2000-memory.dmp
                            Filesize

                            8KB

                          • memory/4256-124-0x00007FF6E3894060-mapping.dmp
                          • memory/4256-127-0x00000263CECC0000-0x00000263CECC2000-memory.dmp
                            Filesize

                            8KB

                          • memory/4256-128-0x00000263CECC0000-0x00000263CECC2000-memory.dmp
                            Filesize

                            8KB

                          • memory/4564-172-0x00000281786B0000-0x00000281786B4000-memory.dmp
                            Filesize

                            16KB

                          • memory/4564-123-0x0000028178730000-0x0000028178732000-memory.dmp
                            Filesize

                            8KB

                          • memory/4564-122-0x0000028178730000-0x0000028178732000-memory.dmp
                            Filesize

                            8KB

                          • memory/4564-147-0x0000028178A50000-0x0000028178A9D000-memory.dmp
                            Filesize

                            308KB

                          • memory/4564-148-0x0000028178B10000-0x0000028178B82000-memory.dmp
                            Filesize

                            456KB

                          • memory/4564-170-0x0000028178770000-0x0000028178774000-memory.dmp
                            Filesize

                            16KB

                          • memory/4564-169-0x0000028178770000-0x0000028178771000-memory.dmp
                            Filesize

                            4KB

                          • memory/4564-168-0x0000028178780000-0x0000028178784000-memory.dmp
                            Filesize

                            16KB