Analysis
-
max time kernel
152s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
04/12/2021, 17:54
Static task
static1
Behavioral task
behavioral1
Sample
DCQPKX.bin
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DCQPKX.bin
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
DCQPKX.bin
-
Size
118KB
-
MD5
10f237e6da56cf46bfd0ea8c22544bee
-
SHA1
d83d7974796fd286f24dd606cf11b444ca55e249
-
SHA256
6f4c49af2816b18488a1f4e2c08380c719df849c7030652e4971332ba3100927
-
SHA512
834b6c9b3cfe740c3c0560f974e399d9efd2ca4586580bf148a43285b2cc4c0ad21ed05869587143be448f6fb42fa4b8dea9f2a2c585c4bfb77ba8056130c1ab
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty" Argos.exe -
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4632 Argos.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\desktop.ini Argos.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\System32\README.txt DCQPKX.bin File created C:\Program Files\System32\Argos.exe DCQPKX.bin File created C:\Program Files\System32\Bunifu_UI_v1.52.dll DCQPKX.bin -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3848 DCQPKX.bin 3848 DCQPKX.bin 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3848 DCQPKX.bin Token: SeDebugPrivilege 4632 Argos.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe 4632 Argos.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 796 wrote to memory of 3848 796 cmd.exe 69 PID 796 wrote to memory of 3848 796 cmd.exe 69 PID 3848 wrote to memory of 4632 3848 DCQPKX.bin 71 PID 3848 wrote to memory of 4632 3848 DCQPKX.bin 71
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\DCQPKX.bin1⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\DCQPKX.binC:\Users\Admin\AppData\Local\Temp\DCQPKX.bin2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Program Files\System32\Argos.exe"C:\Program Files\System32\Argos.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4632
-
-