Analysis
-
max time kernel
1194s -
max time network
1208s -
platform
windows11_x64 -
resource
win11 -
submitted
11/11/2021, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
78556a2fc01c40f64f11c76ef26ec3ff.exe
Resource
win7-ja-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
78556a2fc01c40f64f11c76ef26ec3ff.exe
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
78556a2fc01c40f64f11c76ef26ec3ff.exe
Resource
win7-de-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
78556a2fc01c40f64f11c76ef26ec3ff.exe
Resource
win11
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
78556a2fc01c40f64f11c76ef26ec3ff.exe
Resource
win10-ja-20211014
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
78556a2fc01c40f64f11c76ef26ec3ff.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
78556a2fc01c40f64f11c76ef26ec3ff.exe
Resource
win10-de-20211104
windows10_x64
0 signatures
0 seconds
General
-
Target
78556a2fc01c40f64f11c76ef26ec3ff.exe
-
Size
4.9MB
-
MD5
78556a2fc01c40f64f11c76ef26ec3ff
-
SHA1
b66a7117d0e22dc0421337e20612ea08f1b2c9e3
-
SHA256
7d3192cad53f934173187f91d8555065d69e09b4f127275a1d47f9f1f9405c5c
-
SHA512
c001603616e7539612e75707664c5356f3fc16a2e6e9033a77f0d4f3cf2854a71310f194e8d9f41207f41c1b60bd7b8fcd49797ba3cfc96a2d406bc55ab104d3
Score
10/10
Malware Config
Signatures
-
StrongPity
StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
-
StrongPity Spyware 3 IoCs
resource yara_rule behavioral4/files/0x000300000001fce3-149.dat family_strongpity behavioral4/files/0x000300000001fce3-150.dat family_strongpity behavioral4/files/0x000300000001fce3-151.dat family_strongpity -
Executes dropped EXE 4 IoCs
pid Process 1012 npp.8.1.7.Installer.x64.exe 476 winpickr.exe 1876 winpickr.exe 1524 ntuis32.exe -
Sets service image path in registry 2 TTPs
-
Loads dropped DLL 4 IoCs
pid Process 1012 npp.8.1.7.Installer.x64.exe 1012 npp.8.1.7.Installer.x64.exe 1012 npp.8.1.7.Installer.x64.exe 1012 npp.8.1.7.Installer.x64.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\winpickr.exe 78556a2fc01c40f64f11c76ef26ec3ff.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs winpickr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1876 winpickr.exe 1876 winpickr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2400 svchost.exe Token: SeCreatePagefilePrivilege 2400 svchost.exe Token: SeShutdownPrivilege 2400 svchost.exe Token: SeCreatePagefilePrivilege 2400 svchost.exe Token: SeShutdownPrivilege 2400 svchost.exe Token: SeCreatePagefilePrivilege 2400 svchost.exe Token: SeShutdownPrivilege 2324 svchost.exe Token: SeCreatePagefilePrivilege 2324 svchost.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe Token: SeSecurityPrivilege 3992 TiWorker.exe Token: SeBackupPrivilege 3992 TiWorker.exe Token: SeRestorePrivilege 3992 TiWorker.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 780 wrote to memory of 1012 780 78556a2fc01c40f64f11c76ef26ec3ff.exe 80 PID 780 wrote to memory of 1012 780 78556a2fc01c40f64f11c76ef26ec3ff.exe 80 PID 780 wrote to memory of 1012 780 78556a2fc01c40f64f11c76ef26ec3ff.exe 80 PID 780 wrote to memory of 476 780 78556a2fc01c40f64f11c76ef26ec3ff.exe 81 PID 780 wrote to memory of 476 780 78556a2fc01c40f64f11c76ef26ec3ff.exe 81 PID 780 wrote to memory of 476 780 78556a2fc01c40f64f11c76ef26ec3ff.exe 81 PID 1876 wrote to memory of 1524 1876 winpickr.exe 87 PID 1876 wrote to memory of 1524 1876 winpickr.exe 87 PID 1876 wrote to memory of 1524 1876 winpickr.exe 87 PID 2324 wrote to memory of 2216 2324 svchost.exe 89 PID 2324 wrote to memory of 2216 2324 svchost.exe 89 PID 2324 wrote to memory of 3260 2324 svchost.exe 109 PID 2324 wrote to memory of 3260 2324 svchost.exe 109 PID 2324 wrote to memory of 3312 2324 svchost.exe 110 PID 2324 wrote to memory of 3312 2324 svchost.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\78556a2fc01c40f64f11c76ef26ec3ff.exe"C:\Users\Admin\AppData\Local\Temp\78556a2fc01c40f64f11c76ef26ec3ff.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\npp.8.1.7.Installer.x64.exe"C:\Users\Admin\AppData\Local\Temp\npp.8.1.7.Installer.x64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012
-
-
C:\Windows\SysWOW64\winpickr.exeC:\Windows\system32\\winpickr.exe update2⤵
- Executes dropped EXE
PID:476
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe e9c9949297a9b53d28d70458f37a614e 3/aaMElYZ0uRt/xCEjQ3LQ.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:1436
-
C:\Windows\SysWOW64\winpickr.exeC:\Windows\SysWOW64\winpickr.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\ProgramData\Microsoft\WindowsData\ntuis32.exe"C:\ProgramData\Microsoft\WindowsData\ntuis32.exe"2⤵
- Executes dropped EXE
PID:1524
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵PID:2216
-
-
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵PID:3260
-
-
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵PID:3312
-
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe e9c9949297a9b53d28d70458f37a614e 3/aaMElYZ0uRt/xCEjQ3LQ.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:1964
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe e9c9949297a9b53d28d70458f37a614e 3/aaMElYZ0uRt/xCEjQ3LQ.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:3948