Resubmissions

25-11-2021 12:39

211125-pvmtfafbhm 8

Analysis

  • max time kernel
    129s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    25-11-2021 12:39

General

  • Target

    79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe

  • Size

    4.6MB

  • MD5

    fe1de0acb3aa75f88f61a784288a32d1

  • SHA1

    d973f591f56c3d53aac4e2da4a3eede185c910d9

  • SHA256

    79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10

  • SHA512

    084770ea021d7d52b50228d1ca6277a9fb5880ae22378c297d24b4bccaca7919a207954350f3257485c010ec0c0cdc6e6548a2508bba1e090647465aa160cf7e

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe
    "C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp" /SL5="$80154,4018938,831488,C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:964
      • C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe
        "C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe" /VERYSILENT
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1368
        • C:\Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp" /SL5="$5012A,4018938,831488,C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1812
          • C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
            "C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:764
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 264
              6⤵
              • Loads dropped DLL
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1328

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    MD5

    eb8e24c85edf254cf3f2c1344842b55f

    SHA1

    2da756889e7e93b4019bb91ff74cd06866a4ec86

    SHA256

    e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d

    SHA512

    e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61

  • C:\Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    MD5

    eb8e24c85edf254cf3f2c1344842b55f

    SHA1

    2da756889e7e93b4019bb91ff74cd06866a4ec86

    SHA256

    e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d

    SHA512

    e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61

  • C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
    MD5

    81acde2ff13a5f79e0d172f3af07d7c0

    SHA1

    a07ce9830d50d2c3d94e7df41de032b04fe641d2

    SHA256

    c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

    SHA512

    9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

  • C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
    MD5

    81acde2ff13a5f79e0d172f3af07d7c0

    SHA1

    a07ce9830d50d2c3d94e7df41de032b04fe641d2

    SHA256

    c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

    SHA512

    9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

  • C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\libvorbisenc-2.dll
    MD5

    958de7dd326bd45460ecb5082064df4c

    SHA1

    42e0da2a5c761641cfa2ff8d57ea21a3325f7606

    SHA256

    f89d307fa7c880e72b2f3b5827d755943f1c7ad3a98683a22de721f1fce2e38c

    SHA512

    dfe4d1a7c73a0ccfe505501bf7b41976616c3db61b8f44d0dda5537e1321fdc02ad9963c0e0e901020c91b6803782faf195ccdc687d9e4bd2be95c1afb78f894

  • \Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    MD5

    eb8e24c85edf254cf3f2c1344842b55f

    SHA1

    2da756889e7e93b4019bb91ff74cd06866a4ec86

    SHA256

    e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d

    SHA512

    e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61

  • \Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp
    MD5

    eb8e24c85edf254cf3f2c1344842b55f

    SHA1

    2da756889e7e93b4019bb91ff74cd06866a4ec86

    SHA256

    e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d

    SHA512

    e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61

  • \Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
    MD5

    81acde2ff13a5f79e0d172f3af07d7c0

    SHA1

    a07ce9830d50d2c3d94e7df41de032b04fe641d2

    SHA256

    c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

    SHA512

    9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

  • \Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
    MD5

    81acde2ff13a5f79e0d172f3af07d7c0

    SHA1

    a07ce9830d50d2c3d94e7df41de032b04fe641d2

    SHA256

    c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

    SHA512

    9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

  • \Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
    MD5

    81acde2ff13a5f79e0d172f3af07d7c0

    SHA1

    a07ce9830d50d2c3d94e7df41de032b04fe641d2

    SHA256

    c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

    SHA512

    9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

  • \Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
    MD5

    81acde2ff13a5f79e0d172f3af07d7c0

    SHA1

    a07ce9830d50d2c3d94e7df41de032b04fe641d2

    SHA256

    c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

    SHA512

    9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

  • \Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
    MD5

    81acde2ff13a5f79e0d172f3af07d7c0

    SHA1

    a07ce9830d50d2c3d94e7df41de032b04fe641d2

    SHA256

    c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

    SHA512

    9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

  • \Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
    MD5

    81acde2ff13a5f79e0d172f3af07d7c0

    SHA1

    a07ce9830d50d2c3d94e7df41de032b04fe641d2

    SHA256

    c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

    SHA512

    9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

  • \Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
    MD5

    81acde2ff13a5f79e0d172f3af07d7c0

    SHA1

    a07ce9830d50d2c3d94e7df41de032b04fe641d2

    SHA256

    c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

    SHA512

    9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

  • \Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
    MD5

    81acde2ff13a5f79e0d172f3af07d7c0

    SHA1

    a07ce9830d50d2c3d94e7df41de032b04fe641d2

    SHA256

    c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

    SHA512

    9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

  • \Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe
    MD5

    81acde2ff13a5f79e0d172f3af07d7c0

    SHA1

    a07ce9830d50d2c3d94e7df41de032b04fe641d2

    SHA256

    c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d

    SHA512

    9d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0

  • \Users\Admin\AppData\Roaming\PhantomJS WebKit\libvorbisenc-2.dll
    MD5

    958de7dd326bd45460ecb5082064df4c

    SHA1

    42e0da2a5c761641cfa2ff8d57ea21a3325f7606

    SHA256

    f89d307fa7c880e72b2f3b5827d755943f1c7ad3a98683a22de721f1fce2e38c

    SHA512

    dfe4d1a7c73a0ccfe505501bf7b41976616c3db61b8f44d0dda5537e1321fdc02ad9963c0e0e901020c91b6803782faf195ccdc687d9e4bd2be95c1afb78f894

  • memory/764-77-0x0000000000000000-mapping.dmp
  • memory/964-63-0x00000000001D0000-0x00000000001D1000-memory.dmp
    Filesize

    4KB

  • memory/964-60-0x0000000000000000-mapping.dmp
  • memory/1328-81-0x0000000000000000-mapping.dmp
  • memory/1328-91-0x00000000006B0000-0x00000000006B1000-memory.dmp
    Filesize

    4KB

  • memory/1368-69-0x0000000000400000-0x00000000004D8000-memory.dmp
    Filesize

    864KB

  • memory/1368-64-0x0000000000000000-mapping.dmp
  • memory/1504-58-0x0000000000400000-0x00000000004D8000-memory.dmp
    Filesize

    864KB

  • memory/1504-55-0x0000000075141000-0x0000000075143000-memory.dmp
    Filesize

    8KB

  • memory/1812-74-0x0000000074391000-0x0000000074393000-memory.dmp
    Filesize

    8KB

  • memory/1812-73-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

  • memory/1812-70-0x0000000000000000-mapping.dmp