Resubmissions
01/12/2021, 22:56
211201-2ws33abgf4101/12/2021, 22:55
211201-2v518sgfdl101/12/2021, 22:53
211201-2t11wsbge6101/12/2021, 22:51
211201-2s416agfcm101/12/2021, 22:27
211201-2c978sbfb5101/12/2021, 22:27
211201-2c4qfsbfb2101/12/2021, 22:23
211201-2at38sbeh3430/11/2021, 22:48
211130-2q8xbsghbq130/11/2021, 22:46
211130-2p6qkscah5130/11/2021, 22:41
211130-2l6amscag61Analysis
- max time kernel
102s - max time network
110s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
01/12/2021, 22:23
General
- Target [email protected]
- Size 31KB
- Sample211201-2at38sbeh3
- SHA256 4663715548c70eec7e9cbf272171493d47a75d2652e38cca870412ea9e749fe9
Malware Config
Signatures
- Drops file in Windows directory 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\mountvol.exemountvol c:\ /d2⤵
-
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/824-118-0x0000000000550000-0x0000000000551000-memory.dmp
memory/824-120-0x0000000000A70000-0x0000000000A72000-memory.dmp
memory/3220-171-0x00000184A7A80000-0x00000184A7A82000-memory.dmp
memory/3220-174-0x00000184A7A80000-0x00000184A7A82000-memory.dmp
memory/3220-173-0x00000184A7A80000-0x00000184A7A82000-memory.dmp
memory/3220-200-0x00000184C00F0000-0x00000184C00F2000-memory.dmp
memory/3220-201-0x00000184C00F3000-0x00000184C00F5000-memory.dmp
memory/3220-172-0x00000184A7A80000-0x00000184A7A82000-memory.dmp
memory/3220-170-0x00000184A7A80000-0x00000184A7A82000-memory.dmp
memory/3220-167-0x00000184A7A80000-0x00000184A7A82000-memory.dmp
memory/3220-168-0x00000184A7A80000-0x00000184A7A82000-memory.dmp
memory/3220-166-0x00000184A7A80000-0x00000184A7A82000-memory.dmp
memory/3220-165-0x00000184A7A80000-0x00000184A7A82000-memory.dmp
memory/3220-164-0x00000184A7A80000-0x00000184A7A82000-memory.dmp
memory/3932-126-0x000001AAF3410000-0x000001AAF3411000-memory.dmp
memory/3932-158-0x000001AAF5AD0000-0x000001AAF5AD1000-memory.dmp
memory/3932-147-0x000001AAF3463000-0x000001AAF3465000-memory.dmp
memory/3932-145-0x000001AAF58B0000-0x000001AAF58B1000-memory.dmp
memory/3932-146-0x000001AAF3460000-0x000001AAF3462000-memory.dmp
memory/3932-131-0x000001AAF2CD0000-0x000001AAF2CD2000-memory.dmp
memory/3932-129-0x000001AAF2CD0000-0x000001AAF2CD2000-memory.dmp
memory/3932-130-0x000001AAF2CD0000-0x000001AAF2CD2000-memory.dmp
memory/3932-128-0x000001AAF2CD0000-0x000001AAF2CD2000-memory.dmp
memory/3932-127-0x000001AAF2CD0000-0x000001AAF2CD2000-memory.dmp
memory/3932-125-0x000001AAF2CD0000-0x000001AAF2CD2000-memory.dmp
memory/3932-124-0x000001AAF2CD0000-0x000001AAF2CD2000-memory.dmp
memory/3932-123-0x000001AAF2CD0000-0x000001AAF2CD2000-memory.dmp
memory/3932-122-0x000001AAF2CD0000-0x000001AAF2CD2000-memory.dmp
memory/3932-121-0x000001AAF2CD0000-0x000001AAF2CD2000-memory.dmp