Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    10-11-2021 15:02

General

  • Target

    7dc7ca24149bd2f34bc1bf8942cb3ed8730482e4e90a16b5333092ddb80bd084.exe

  • Size

    96KB

  • MD5

    c202f1103c957930ec4cc01b43dfd472

  • SHA1

    ffed9fc2e035d31f1b2e098471e8ec70334ff9fc

  • SHA256

    7dc7ca24149bd2f34bc1bf8942cb3ed8730482e4e90a16b5333092ddb80bd084

  • SHA512

    569aa632a2677cb9d1b0186f19676161853ceea55cb6ee94cfcc6ad4b558c57a2694ab0d2dc541484e4099530b2aab742b95d08c093150efa6585d98ce6356e4

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 18 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s BITS
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k SystemNetworkService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1928
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2756
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2652
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\system32\wbem\WMIADAP.EXE
          wmiadap.exe /F /T /R
          2⤵
            PID:3512
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2468
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2448
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1884
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1448
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1300
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                    1⤵
                      PID:1232
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1064
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                          PID:384
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                          1⤵
                            PID:292
                          • C:\Users\Admin\AppData\Local\Temp\7dc7ca24149bd2f34bc1bf8942cb3ed8730482e4e90a16b5333092ddb80bd084.exe
                            "C:\Users\Admin\AppData\Local\Temp\7dc7ca24149bd2f34bc1bf8942cb3ed8730482e4e90a16b5333092ddb80bd084.exe"
                            1⤵
                              PID:1012
                            • C:\Windows\system32\rundll32.exe
                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                              1⤵
                              • Process spawned unexpected child process
                              • Suspicious use of WriteProcessMemory
                              PID:3836
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                2⤵
                                • Loads dropped DLL
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:3972

                            Network

                            MITRE ATT&CK Matrix ATT&CK v6

                            Discovery

                            System Information Discovery

                            2
                            T1082

                            Query Registry

                            1
                            T1012

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
                              MD5

                              5de5a43c91fdada5f04eddb6d22fb67d

                              SHA1

                              e23e97e72605cf14a13272a85886a0feffaab93a

                              SHA256

                              035d368cf70cee43220fb3b4987c019a9b28052f140d7a52a57be3238981ec62

                              SHA512

                              203ebb534553d0f9dae4a88cf0946f6a1b3dcfa7be4b1cddafd9fb55f345833fea311dda8c1fb73602c73547c323c4210d8c18785475935b4e74c9f50e8a52ec

                            • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
                              MD5

                              d2c3e38d64273ea56d503bb3fb2a8b5d

                              SHA1

                              177da7d99381bbc83ede6b50357f53944240d862

                              SHA256

                              25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                              SHA512

                              2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                            • \Users\Admin\AppData\Local\Temp\sqlite.dll
                              MD5

                              d2c3e38d64273ea56d503bb3fb2a8b5d

                              SHA1

                              177da7d99381bbc83ede6b50357f53944240d862

                              SHA256

                              25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

                              SHA512

                              2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

                            • memory/292-191-0x000001C8A6CB0000-0x000001C8A6D22000-memory.dmp
                              Filesize

                              456KB

                            • memory/292-157-0x000001C8A6620000-0x000001C8A6692000-memory.dmp
                              Filesize

                              456KB

                            • memory/292-179-0x000001C8A5DC0000-0x000001C8A5DC2000-memory.dmp
                              Filesize

                              8KB

                            • memory/292-134-0x000001C8A5DC0000-0x000001C8A5DC2000-memory.dmp
                              Filesize

                              8KB

                            • memory/292-133-0x000001C8A5DC0000-0x000001C8A5DC2000-memory.dmp
                              Filesize

                              8KB

                            • memory/384-195-0x000002E98A850000-0x000002E98A8C2000-memory.dmp
                              Filesize

                              456KB

                            • memory/384-142-0x000002E989E50000-0x000002E989E52000-memory.dmp
                              Filesize

                              8KB

                            • memory/384-141-0x000002E989E50000-0x000002E989E52000-memory.dmp
                              Filesize

                              8KB

                            • memory/384-183-0x000002E989E50000-0x000002E989E52000-memory.dmp
                              Filesize

                              8KB

                            • memory/384-161-0x000002E98A760000-0x000002E98A7D2000-memory.dmp
                              Filesize

                              456KB

                            • memory/1064-182-0x000002372EBF0000-0x000002372EBF2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1064-194-0x000002372F9F0000-0x000002372FA62000-memory.dmp
                              Filesize

                              456KB

                            • memory/1064-160-0x000002372F970000-0x000002372F9E2000-memory.dmp
                              Filesize

                              456KB

                            • memory/1064-139-0x000002372EBF0000-0x000002372EBF2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1064-140-0x000002372EBF0000-0x000002372EBF2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1232-199-0x0000023035D10000-0x0000023035D82000-memory.dmp
                              Filesize

                              456KB

                            • memory/1232-165-0x0000023035780000-0x00000230357F2000-memory.dmp
                              Filesize

                              456KB

                            • memory/1232-150-0x00000230354E0000-0x00000230354E2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1232-149-0x00000230354E0000-0x00000230354E2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1232-187-0x00000230354E0000-0x00000230354E2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1300-148-0x000002583DE30000-0x000002583DE32000-memory.dmp
                              Filesize

                              8KB

                            • memory/1300-198-0x000002583EC40000-0x000002583ECB2000-memory.dmp
                              Filesize

                              456KB

                            • memory/1300-164-0x000002583E270000-0x000002583E2E2000-memory.dmp
                              Filesize

                              456KB

                            • memory/1300-186-0x000002583DE30000-0x000002583DE32000-memory.dmp
                              Filesize

                              8KB

                            • memory/1300-147-0x000002583DE30000-0x000002583DE32000-memory.dmp
                              Filesize

                              8KB

                            • memory/1448-196-0x000001AFBE6C0000-0x000001AFBE732000-memory.dmp
                              Filesize

                              456KB

                            • memory/1448-144-0x000001AFBD8A0000-0x000001AFBD8A2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1448-143-0x000001AFBD8A0000-0x000001AFBD8A2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1448-184-0x000001AFBD8A0000-0x000001AFBD8A2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1448-162-0x000001AFBE640000-0x000001AFBE6B2000-memory.dmp
                              Filesize

                              456KB

                            • memory/1884-145-0x0000027DEAA20000-0x0000027DEAA22000-memory.dmp
                              Filesize

                              8KB

                            • memory/1884-185-0x0000027DEAA20000-0x0000027DEAA22000-memory.dmp
                              Filesize

                              8KB

                            • memory/1884-197-0x0000027DEB7B0000-0x0000027DEB822000-memory.dmp
                              Filesize

                              456KB

                            • memory/1884-163-0x0000027DEB1D0000-0x0000027DEB242000-memory.dmp
                              Filesize

                              456KB

                            • memory/1884-146-0x0000027DEAA20000-0x0000027DEAA22000-memory.dmp
                              Filesize

                              8KB

                            • memory/1928-171-0x000002005DB00000-0x000002005DC05000-memory.dmp
                              Filesize

                              1.0MB

                            • memory/1928-169-0x000002005CAF0000-0x000002005CAF2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1928-168-0x000002005CAF0000-0x000002005CAF2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1928-131-0x000002005CAF0000-0x000002005CAF2000-memory.dmp
                              Filesize

                              8KB

                            • memory/1928-156-0x000002005B2D0000-0x000002005B342000-memory.dmp
                              Filesize

                              456KB

                            • memory/1928-170-0x000002005CBC0000-0x000002005CBDB000-memory.dmp
                              Filesize

                              108KB

                            • memory/1928-129-0x00007FF693A24060-mapping.dmp
                            • memory/1928-132-0x000002005CAF0000-0x000002005CAF2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2448-137-0x000001ACEAD90000-0x000001ACEAD92000-memory.dmp
                              Filesize

                              8KB

                            • memory/2448-181-0x000001ACEAD90000-0x000001ACEAD92000-memory.dmp
                              Filesize

                              8KB

                            • memory/2448-193-0x000001ACEAE80000-0x000001ACEAEF2000-memory.dmp
                              Filesize

                              456KB

                            • memory/2448-159-0x000001ACEAD10000-0x000001ACEAD82000-memory.dmp
                              Filesize

                              456KB

                            • memory/2448-138-0x000001ACEAD90000-0x000001ACEAD92000-memory.dmp
                              Filesize

                              8KB

                            • memory/2468-135-0x000002C363CE0000-0x000002C363CE2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2468-192-0x000002C364B40000-0x000002C364BB2000-memory.dmp
                              Filesize

                              456KB

                            • memory/2468-136-0x000002C363CE0000-0x000002C363CE2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2468-158-0x000002C364540000-0x000002C3645B2000-memory.dmp
                              Filesize

                              456KB

                            • memory/2468-180-0x000002C363CE0000-0x000002C363CE2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2632-200-0x0000015CEFF80000-0x0000015CEFFF2000-memory.dmp
                              Filesize

                              456KB

                            • memory/2632-166-0x0000015CEFF00000-0x0000015CEFF72000-memory.dmp
                              Filesize

                              456KB

                            • memory/2632-152-0x0000015CEF500000-0x0000015CEF502000-memory.dmp
                              Filesize

                              8KB

                            • memory/2632-151-0x0000015CEF500000-0x0000015CEF502000-memory.dmp
                              Filesize

                              8KB

                            • memory/2632-188-0x0000015CEF500000-0x0000015CEF502000-memory.dmp
                              Filesize

                              8KB

                            • memory/2652-154-0x000001D880130000-0x000001D880132000-memory.dmp
                              Filesize

                              8KB

                            • memory/2652-201-0x000001D880EB0000-0x000001D880F22000-memory.dmp
                              Filesize

                              456KB

                            • memory/2652-153-0x000001D880130000-0x000001D880132000-memory.dmp
                              Filesize

                              8KB

                            • memory/2652-189-0x000001D880130000-0x000001D880132000-memory.dmp
                              Filesize

                              8KB

                            • memory/2652-167-0x000001D880920000-0x000001D880992000-memory.dmp
                              Filesize

                              456KB

                            • memory/2756-130-0x000001B7C2CD0000-0x000001B7C2CD2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2756-190-0x000001B7C3940000-0x000001B7C39B2000-memory.dmp
                              Filesize

                              456KB

                            • memory/2756-178-0x000001B7C2CD0000-0x000001B7C2CD2000-memory.dmp
                              Filesize

                              8KB

                            • memory/2756-155-0x000001B7C2E10000-0x000001B7C2E82000-memory.dmp
                              Filesize

                              456KB

                            • memory/2756-128-0x000001B7C2CD0000-0x000001B7C2CD2000-memory.dmp
                              Filesize

                              8KB

                            • memory/3512-172-0x0000000000000000-mapping.dmp
                            • memory/3960-127-0x000001D0827A0000-0x000001D082812000-memory.dmp
                              Filesize

                              456KB

                            • memory/3960-173-0x000001D082430000-0x000001D082434000-memory.dmp
                              Filesize

                              16KB

                            • memory/3960-174-0x000001D082420000-0x000001D082421000-memory.dmp
                              Filesize

                              4KB

                            • memory/3960-125-0x000001D082410000-0x000001D082412000-memory.dmp
                              Filesize

                              8KB

                            • memory/3960-124-0x000001D082410000-0x000001D082412000-memory.dmp
                              Filesize

                              8KB

                            • memory/3960-126-0x000001D0826E0000-0x000001D08272D000-memory.dmp
                              Filesize

                              308KB

                            • memory/3960-177-0x000001D082330000-0x000001D082334000-memory.dmp
                              Filesize

                              16KB

                            • memory/3960-175-0x000001D082420000-0x000001D082424000-memory.dmp
                              Filesize

                              16KB

                            • memory/3972-123-0x0000000000E70000-0x0000000000ECD000-memory.dmp
                              Filesize

                              372KB

                            • memory/3972-122-0x00000000047B7000-0x00000000048B8000-memory.dmp
                              Filesize

                              1.0MB

                            • memory/3972-119-0x0000000000000000-mapping.dmp