Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07-01-2022 01:02
Static task
static1
Behavioral task
behavioral1
Sample
0a7dba172f5485536a67007bbb67f209.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0a7dba172f5485536a67007bbb67f209.exe
Resource
win10-en-20211208
General
-
Target
0a7dba172f5485536a67007bbb67f209.exe
-
Size
2.3MB
-
MD5
0a7dba172f5485536a67007bbb67f209
-
SHA1
7352fbbee9419e6afe958bfd34d55ffafeda0d58
-
SHA256
f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736
-
SHA512
6f2c94a396ed78e925c0d3dd6926498a7ba78bb5a111287b5c0b1122681e196fc526496a433e5b3b431988a5d6eb75218d0b5c814971163dbc489193454d14ba
Malware Config
Extracted
bitrat
1.38
severdops.ddns.net:3071
-
communication_password
29ef52e7563626a96cea7f4b4085c124
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1440-69-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral1/memory/1440-70-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral1/memory/1440-71-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral1/memory/1440-72-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral1/memory/1440-75-0x0000000000400000-0x00000000007E5000-memory.dmp upx behavioral1/memory/1440-77-0x0000000000400000-0x00000000007E5000-memory.dmp upx -
Processes:
0a7dba172f5485536a67007bbb67f209.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths 0a7dba172f5485536a67007bbb67f209.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions 0a7dba172f5485536a67007bbb67f209.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\GLOSSERSECC\svchost.exe = "0" 0a7dba172f5485536a67007bbb67f209.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\0a7dba172f5485536a67007bbb67f209.exe = "0" 0a7dba172f5485536a67007bbb67f209.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0a7dba172f5485536a67007bbb67f209.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\MURRINEADC = "C:\\Windows\\Microsoft.NET\\Framework\\GLOSSERSECC\\svchost.exe" 0a7dba172f5485536a67007bbb67f209.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\MURRINEADC = "C:\\Windows\\Microsoft.NET\\Framework\\GLOSSERSECC\\svchost.exe" 0a7dba172f5485536a67007bbb67f209.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
mscorsvw.exepid process 1440 mscorsvw.exe 1440 mscorsvw.exe 1440 mscorsvw.exe 1440 mscorsvw.exe 1440 mscorsvw.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0a7dba172f5485536a67007bbb67f209.exedescription pid process target process PID 1592 set thread context of 1440 1592 0a7dba172f5485536a67007bbb67f209.exe mscorsvw.exe -
Drops file in Windows directory 2 IoCs
Processes:
0a7dba172f5485536a67007bbb67f209.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\GLOSSERSECC\svchost.exe 0a7dba172f5485536a67007bbb67f209.exe File opened for modification C:\Windows\Microsoft.NET\Framework\GLOSSERSECC 0a7dba172f5485536a67007bbb67f209.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
0a7dba172f5485536a67007bbb67f209.exepowershell.exepowershell.exepowershell.exepid process 1592 0a7dba172f5485536a67007bbb67f209.exe 1592 0a7dba172f5485536a67007bbb67f209.exe 584 powershell.exe 432 powershell.exe 820 powershell.exe 1592 0a7dba172f5485536a67007bbb67f209.exe 1592 0a7dba172f5485536a67007bbb67f209.exe 1592 0a7dba172f5485536a67007bbb67f209.exe 1592 0a7dba172f5485536a67007bbb67f209.exe 1592 0a7dba172f5485536a67007bbb67f209.exe 1592 0a7dba172f5485536a67007bbb67f209.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
0a7dba172f5485536a67007bbb67f209.exepowershell.exepowershell.exepowershell.exemscorsvw.exedescription pid process Token: SeDebugPrivilege 1592 0a7dba172f5485536a67007bbb67f209.exe Token: SeDebugPrivilege 584 powershell.exe Token: SeDebugPrivilege 820 powershell.exe Token: SeDebugPrivilege 432 powershell.exe Token: SeDebugPrivilege 1440 mscorsvw.exe Token: SeShutdownPrivilege 1440 mscorsvw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mscorsvw.exepid process 1440 mscorsvw.exe 1440 mscorsvw.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
0a7dba172f5485536a67007bbb67f209.exedescription pid process target process PID 1592 wrote to memory of 432 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 432 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 432 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 432 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 584 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 584 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 584 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 584 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 820 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 820 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 820 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 820 1592 0a7dba172f5485536a67007bbb67f209.exe powershell.exe PID 1592 wrote to memory of 1440 1592 0a7dba172f5485536a67007bbb67f209.exe mscorsvw.exe PID 1592 wrote to memory of 1440 1592 0a7dba172f5485536a67007bbb67f209.exe mscorsvw.exe PID 1592 wrote to memory of 1440 1592 0a7dba172f5485536a67007bbb67f209.exe mscorsvw.exe PID 1592 wrote to memory of 1440 1592 0a7dba172f5485536a67007bbb67f209.exe mscorsvw.exe PID 1592 wrote to memory of 1440 1592 0a7dba172f5485536a67007bbb67f209.exe mscorsvw.exe PID 1592 wrote to memory of 1440 1592 0a7dba172f5485536a67007bbb67f209.exe mscorsvw.exe PID 1592 wrote to memory of 1440 1592 0a7dba172f5485536a67007bbb67f209.exe mscorsvw.exe PID 1592 wrote to memory of 1440 1592 0a7dba172f5485536a67007bbb67f209.exe mscorsvw.exe PID 1592 wrote to memory of 1440 1592 0a7dba172f5485536a67007bbb67f209.exe mscorsvw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a7dba172f5485536a67007bbb67f209.exe"C:\Users\Admin\AppData\Local\Temp\0a7dba172f5485536a67007bbb67f209.exe"1⤵
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\GLOSSERSECC\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\GLOSSERSECC\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0a7dba172f5485536a67007bbb67f209.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
3955dca7bcaa31f96829bc55a8b583c3
SHA1d3d7069d2b8e599e9d0aa479190d1d3d943ebb5f
SHA256b0bd4e460d83fed257bb11e52f1f750315a5fd2f45f3cbf507a763f431b1ef8e
SHA512d351ec0d4016223fd5b256d49e17beeccedb90200167e254cbb1073500680638f3cda08a909b18450c51fdeffcd4e84ef47a49ce6747716a41ab8acff7a3c910
-
memory/432-82-0x0000000002580000-0x00000000031CA000-memory.dmpFilesize
12.3MB
-
memory/432-78-0x0000000002580000-0x00000000031CA000-memory.dmpFilesize
12.3MB
-
memory/432-61-0x0000000000000000-mapping.dmp
-
memory/432-64-0x0000000075471000-0x0000000075473000-memory.dmpFilesize
8KB
-
memory/584-81-0x0000000002412000-0x0000000002414000-memory.dmpFilesize
8KB
-
memory/584-79-0x0000000002411000-0x0000000002412000-memory.dmpFilesize
4KB
-
memory/584-74-0x0000000002410000-0x0000000002411000-memory.dmpFilesize
4KB
-
memory/584-62-0x0000000000000000-mapping.dmp
-
memory/820-80-0x0000000002520000-0x000000000316A000-memory.dmpFilesize
12.3MB
-
memory/820-63-0x0000000000000000-mapping.dmp
-
memory/1440-68-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/1440-75-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/1440-69-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/1440-70-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/1440-71-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/1440-72-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/1440-73-0x00000000007E2730-mapping.dmp
-
memory/1440-77-0x0000000000400000-0x00000000007E5000-memory.dmpFilesize
3.9MB
-
memory/1592-60-0x0000000000A90000-0x0000000000B5A000-memory.dmpFilesize
808KB
-
memory/1592-54-0x00000000010F0000-0x0000000001348000-memory.dmpFilesize
2.3MB
-
memory/1592-59-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/1592-58-0x0000000005EF0000-0x00000000060FE000-memory.dmpFilesize
2.1MB
-
memory/1592-57-0x0000000000380000-0x0000000000388000-memory.dmpFilesize
32KB
-
memory/1592-56-0x0000000000370000-0x0000000000378000-memory.dmpFilesize
32KB
-
memory/1592-55-0x0000000000360000-0x0000000000368000-memory.dmpFilesize
32KB