b0abb1e9b7f39644513bff297e18dbc7e8a6a1b00664110a9f8ddf92fa78eea1

General

Target
b6611b450d87333d4f69f7e6c0c56860.exe
Size 931KB
Sample220106-ry5vjabfhr
SHA256 b0abb1e9b7f39644513bff297e18dbc7e8a6a1b00664110a9f8ddf92fa78eea1
MD5 b6611b450d87333d4f69f7e6c0c56860
SHA1 6d4a4819ac546bb6063cea3651ebed88cac54280
SHA512 8c6242e9c2a2ce0c2a9679df3d9339c6dbca5d4450231409beae3386ddafe03611dd0b7a37bbd13799662609b5582d3a9e4012f26d0c27bf9a02cbd2198614f7
MD5 SHA1 SHA512

Score

10^/10

persistence

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	2560	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	2560	schtasks.exe	69
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	2560	schtasks.exe	69

Executes dropped EXE 1 IoCs

pid	Process
1260	dllhost.exe

Adds Run key to start application 2 TTPs 3 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\LiveKernelReports\\spoolsv.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\difxapi\\dllhost.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Google\\Temp\\dllhost.exe\""	b6611b450d87333d4f69f7e6c0c56860.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\difxapi\dllhost.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\System32\difxapi\5940a34987c99120d96dace90a3f93f329dcad63	b6611b450d87333d4f69f7e6c0c56860.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\Icons\taskhostw.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Program Files (x86)\Google\Temp\dllhost.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Program Files (x86)\Google\Temp\5940a34987c99120d96dace90a3f93f329dcad63	b6611b450d87333d4f69f7e6c0c56860.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\LiveKernelReports\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	b6611b450d87333d4f69f7e6c0c56860.exe
File created	C:\Windows\LiveKernelReports\spoolsv.exe	b6611b450d87333d4f69f7e6c0c56860.exe
File opened for modification	C:\Windows\LiveKernelReports\spoolsv.exe	b6611b450d87333d4f69f7e6c0c56860.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings	b6611b450d87333d4f69f7e6c0c56860.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1260	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2900	b6611b450d87333d4f69f7e6c0c56860.exe
Token: SeDebugPrivilege	1260	dllhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2212	2900	b6611b450d87333d4f69f7e6c0c56860.exe	73
PID 2900 wrote to memory of 2212	2900	b6611b450d87333d4f69f7e6c0c56860.exe	73
PID 2212 wrote to memory of 2752	2212	cmd.exe	75
PID 2212 wrote to memory of 2752	2212	cmd.exe	75
PID 2212 wrote to memory of 1260	2212	cmd.exe	76
PID 2212 wrote to memory of 1260	2212	cmd.exe	76