b0abb1e9b7f39644513bff297e18dbc7e8a6a1b00664110a9f8ddf92fa78eea1

General

Target
b6611b450d87333d4f69f7e6c0c56860.exe
Size 931KB
Sample220106-ry5vjabfhr
SHA256 b0abb1e9b7f39644513bff297e18dbc7e8a6a1b00664110a9f8ddf92fa78eea1
MD5 b6611b450d87333d4f69f7e6c0c56860
SHA1 6d4a4819ac546bb6063cea3651ebed88cac54280
SHA512 8c6242e9c2a2ce0c2a9679df3d9339c6dbca5d4450231409beae3386ddafe03611dd0b7a37bbd13799662609b5582d3a9e4012f26d0c27bf9a02cbd2198614f7
MD5 SHA1 SHA512

Score

10^/10

persistence suricata

Malware Config

Signatures

Process spawned unexpected child process 10 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	472	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	472	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	472	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	472	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	472	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	472	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	472	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	472	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	472	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	472	schtasks.exe	27

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

Executes dropped EXE 1 IoCs

pid	Process
1012	lsass.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\security\\database\\dwm.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\TSSysprep\\explorer.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\C_1256\\winlogon.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\Magnification\\lsass.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\Globalization\\ELS\\Transliteration\\System.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\basecsp\\sppsvc.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Public\\Favorites\\wininit.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\wpcao\\lsass.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Default\\Saved Games\\spoolsv.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Public\\Favorites\\Idle.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\wpcao\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\System32\C_1256\winlogon.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\System32\C_1256\cc11b995f2a76da408ea6a601e682e64743153ad	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\System32\basecsp\sppsvc.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\System32\basecsp\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\System32\Magnification\lsass.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\System32\Magnification\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\System32\wpcao\lsass.exe	b6611b450d87333d4f69f7e6c0c56860.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..ilityanalysisengine_31bf3856ad364e35_6.1.7601.17514_none_e692ea18acdcf5bf\audiodg.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\security\database\dwm.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File opened for modification	C:\Windows\security\database\dwm.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\security\database\6cb0b6c459d5d3455a3da700e713f2e2529862ff	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\TSSysprep\explorer.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\TSSysprep\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\Globalization\ELS\Transliteration\System.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\Globalization\ELS\Transliteration\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a	b6611b450d87333d4f69f7e6c0c56860.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1688	schtasks.exe
588	schtasks.exe
1524	schtasks.exe
1532	schtasks.exe
1964	schtasks.exe
616	schtasks.exe
396	schtasks.exe
1828	schtasks.exe
856	schtasks.exe
528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
960	b6611b450d87333d4f69f7e6c0c56860.exe
1012	lsass.exe
1012	lsass.exe
1012	lsass.exe
1012	lsass.exe
1012	lsass.exe
1012	lsass.exe
1012	lsass.exe
1012	lsass.exe
1012	lsass.exe
1012	lsass.exe
1012	lsass.exe
1012	lsass.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1012	lsass.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	b6611b450d87333d4f69f7e6c0c56860.exe
Token: SeDebugPrivilege	1012	lsass.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1904	960	b6611b450d87333d4f69f7e6c0c56860.exe	38
PID 960 wrote to memory of 1904	960	b6611b450d87333d4f69f7e6c0c56860.exe	38
PID 960 wrote to memory of 1904	960	b6611b450d87333d4f69f7e6c0c56860.exe	38
PID 1904 wrote to memory of 708	1904	cmd.exe	40
PID 1904 wrote to memory of 708	1904	cmd.exe	40
PID 1904 wrote to memory of 708	1904	cmd.exe	40
PID 1904 wrote to memory of 1012	1904	cmd.exe	41
PID 1904 wrote to memory of 1012	1904	cmd.exe	41
PID 1904 wrote to memory of 1012	1904	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\b6611b450d87333d4f69f7e6c0c56860.exe
"C:\Users\Admin\AppData\Local\Temp\b6611b450d87333d4f69f7e6c0c56860.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Wj4qU07wE5.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:708
- - C:\Windows\System32\wpcao\lsass.exe
    "C:\Windows\System32\wpcao\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\security\database\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\TSSysprep\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Globalization\ELS\Transliteration\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\C_1256\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\basecsp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\Magnification\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Favorites\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\wpcao\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Favorites\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:856