Analysis
- max time kernel
133s - max time network
133s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
23/12/2021, 08:42
General
- Target a356ab2b778d7117f5a5270b17787a3a.exe
- Size 1.2MB
- Sample211223-kl2tsaabaq
- SHA256 0eaeecd54b382b008e10fb2d18f5689fa047e2f5bd22d90ab8c495c49d20fd87
Malware Config
Signatures
- Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs
- suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 6 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Drops file in System32 directory 20 IoCs
- Drops file in Program Files directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- System policy modification 1 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a356ab2b778d7117f5a5270b17787a3a.exe"C:\Users\Admin\AppData\Local\Temp\a356ab2b778d7117f5a5270b17787a3a.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cacls\dwm.exe"C:\Windows\System32\cacls\dwm.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\ProgramData\WindowsHolographicDevices\SpatialStore\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\cacls\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\fwpolicyiomgr\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\MapsStore\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\wbiosrvc\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2384-133-0x000000001BBE0000-0x000000001BBE4000-memory.dmp
memory/2384-118-0x0000000002A10000-0x0000000002A18000-memory.dmp
memory/2384-119-0x0000000002A40000-0x0000000002A4E000-memory.dmp
memory/2384-120-0x0000000002A20000-0x0000000002A2A000-memory.dmp
memory/2384-121-0x0000000002A50000-0x0000000002A58000-memory.dmp
memory/2384-122-0x0000000002B80000-0x0000000002B8A000-memory.dmp
memory/2384-123-0x0000000002B90000-0x0000000002B9A000-memory.dmp
memory/2384-124-0x0000000002BA0000-0x0000000002BA8000-memory.dmp
memory/2384-125-0x0000000002BB0000-0x0000000002BB8000-memory.dmp
memory/2384-126-0x0000000002BC0000-0x0000000002BCC000-memory.dmp
memory/2384-127-0x0000000002BD0000-0x0000000002BD2000-memory.dmp
memory/2384-128-0x0000000002BD2000-0x0000000002BD4000-memory.dmp
memory/2384-129-0x0000000002BD4000-0x0000000002BD6000-memory.dmp
memory/2384-130-0x0000000002BD6000-0x0000000002BD8000-memory.dmp
memory/2384-131-0x0000000002BD8000-0x0000000002BDA000-memory.dmp
memory/2384-132-0x0000000002BDA000-0x0000000002BDF000-memory.dmp
memory/2384-117-0x00000000011E0000-0x00000000011F0000-memory.dmp
memory/2384-115-0x0000000000810000-0x0000000000954000-memory.dmp
memory/2384-116-0x0000000000810000-0x0000000000954000-memory.dmp
memory/3608-144-0x0000000002AA0000-0x0000000002AA8000-memory.dmp
memory/3608-138-0x0000000000830000-0x0000000000974000-memory.dmp
memory/3608-139-0x0000000002950000-0x0000000002952000-memory.dmp
memory/3608-140-0x0000000002920000-0x0000000002930000-memory.dmp
memory/3608-142-0x0000000002970000-0x000000000297E000-memory.dmp
memory/3608-141-0x0000000002930000-0x0000000002938000-memory.dmp
memory/3608-145-0x0000000002960000-0x000000000296A000-memory.dmp
memory/3608-137-0x0000000000830000-0x0000000000974000-memory.dmp
memory/3608-146-0x0000000002980000-0x000000000298A000-memory.dmp
memory/3608-143-0x0000000002940000-0x000000000294A000-memory.dmp
memory/3608-147-0x0000000002AB0000-0x0000000002AB8000-memory.dmp
memory/3608-148-0x0000000002AC0000-0x0000000002AC8000-memory.dmp
memory/3608-149-0x000000001B4B0000-0x000000001B4BC000-memory.dmp
memory/3608-150-0x0000000002952000-0x0000000002954000-memory.dmp
memory/3608-151-0x0000000002954000-0x0000000002956000-memory.dmp
memory/3608-152-0x0000000002956000-0x0000000002958000-memory.dmp