Analysis
- max time kernel
122s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
07/01/2022, 07:53
General
- Target c055c5f198be863beac77ee77137a8f8.exe
- Size 1.6MB
- Sample220107-jq2txacddp
- SHA256 8592d578f269100d67bf1faa464e23de7bf0c1266bad19d2bf6bcce0501158a3
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Nirsoft 5 IoCs
- Executes dropped EXE 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c055c5f198be863beac77ee77137a8f8.exe"C:\Users\Admin\AppData\Local\Temp\c055c5f198be863beac77ee77137a8f8.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc aQBwAGMAbwBuAGYAaQBnACAALwByAGUAbABlAGEAcwBlAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /release3⤵
- Gathers network information
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc aQBwAGMAbwBuAGYAaQBnACAALwByAGUAbgBlAHcA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /renew3⤵
- Gathers network information
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAuADUA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 48803⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 42723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\c055c5f198be863beac77ee77137a8f8.exeC:\Users\Admin\AppData\Local\Temp\c055c5f198be863beac77ee77137a8f8.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1332-174-0x0000028F8DD80000-0x0000028F8DD82000-memory.dmp
memory/1332-180-0x0000028FA7E06000-0x0000028FA7E08000-memory.dmp
memory/1332-179-0x0000028FA7E03000-0x0000028FA7E05000-memory.dmp
memory/1332-171-0x0000028F8DD80000-0x0000028F8DD82000-memory.dmp
memory/1332-170-0x0000028FA81C0000-0x0000028FA8236000-memory.dmp
memory/1332-169-0x0000028F8DD80000-0x0000028F8DD82000-memory.dmp
memory/1332-168-0x0000028F8DD80000-0x0000028F8DD82000-memory.dmp
memory/1332-167-0x0000028F8DD80000-0x0000028F8DD82000-memory.dmp
memory/1332-175-0x0000028F8DD80000-0x0000028F8DD82000-memory.dmp
memory/1332-165-0x0000028FA7D70000-0x0000028FA7D92000-memory.dmp
memory/1332-164-0x0000028F8DD80000-0x0000028F8DD82000-memory.dmp
memory/1332-178-0x0000028FA7E00000-0x0000028FA7E02000-memory.dmp
memory/1332-162-0x0000028F8DD80000-0x0000028F8DD82000-memory.dmp
memory/1332-163-0x0000028F8DD80000-0x0000028F8DD82000-memory.dmp
memory/1332-161-0x0000028F8DD80000-0x0000028F8DD82000-memory.dmp
memory/2604-184-0x000002C3F2530000-0x000002C3F2532000-memory.dmp
memory/2604-191-0x000002C3F2530000-0x000002C3F2532000-memory.dmp
memory/2604-181-0x000002C3F2530000-0x000002C3F2532000-memory.dmp
memory/2604-183-0x000002C3F2530000-0x000002C3F2532000-memory.dmp
memory/2604-182-0x000002C3F2530000-0x000002C3F2532000-memory.dmp
memory/2604-185-0x000002C3F2930000-0x000002C3F2952000-memory.dmp
memory/2604-201-0x000002C3F2826000-0x000002C3F2828000-memory.dmp
memory/2604-187-0x000002C3F2530000-0x000002C3F2532000-memory.dmp
memory/2604-199-0x000002C3F2530000-0x000002C3F2532000-memory.dmp
memory/2604-198-0x000002C3F2823000-0x000002C3F2825000-memory.dmp
memory/2604-197-0x000002C3F2820000-0x000002C3F2822000-memory.dmp
memory/2604-190-0x000002C3F2C10000-0x000002C3F2C86000-memory.dmp
memory/2604-189-0x000002C3F2530000-0x000002C3F2532000-memory.dmp
memory/2604-188-0x000002C3F2530000-0x000002C3F2532000-memory.dmp
memory/2880-211-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3584-200-0x0000000002AA0000-0x0000000002B5E000-memory.dmp
memory/3584-117-0x000000001B590000-0x000000001B592000-memory.dmp
memory/3584-115-0x0000000000500000-0x0000000000698000-memory.dmp
memory/3584-116-0x0000000000500000-0x0000000000698000-memory.dmp
memory/4004-126-0x0000019B6ACF0000-0x0000019B6ACF2000-memory.dmp
memory/4004-121-0x0000019B6ACF0000-0x0000019B6ACF2000-memory.dmp
memory/4004-129-0x0000019B6ACF0000-0x0000019B6ACF2000-memory.dmp
memory/4004-128-0x0000019B6ACF0000-0x0000019B6ACF2000-memory.dmp
memory/4004-127-0x0000019B6B730000-0x0000019B6B7A6000-memory.dmp
memory/4004-125-0x0000019B6ACF0000-0x0000019B6ACF2000-memory.dmp
memory/4004-119-0x0000019B6ACF0000-0x0000019B6ACF2000-memory.dmp
memory/4004-124-0x0000019B6ACF0000-0x0000019B6ACF2000-memory.dmp
memory/4004-132-0x0000019B6AE70000-0x0000019B6AE72000-memory.dmp
memory/4004-123-0x0000019B6B450000-0x0000019B6B472000-memory.dmp
memory/4004-133-0x0000019B6AE73000-0x0000019B6AE75000-memory.dmp
memory/4004-134-0x0000019B6ACF0000-0x0000019B6ACF2000-memory.dmp
memory/4004-135-0x0000019B6ACF0000-0x0000019B6ACF2000-memory.dmp
memory/4004-120-0x0000019B6ACF0000-0x0000019B6ACF2000-memory.dmp
memory/4004-155-0x0000019B6AE76000-0x0000019B6AE78000-memory.dmp
memory/4004-122-0x0000019B6ACF0000-0x0000019B6ACF2000-memory.dmp
memory/4428-158-0x000001B9FD470000-0x000001B9FD472000-memory.dmp
memory/4428-141-0x000001B9FD470000-0x000001B9FD472000-memory.dmp
memory/4428-159-0x000001B9FD470000-0x000001B9FD472000-memory.dmp
memory/4428-139-0x000001B9FD470000-0x000001B9FD472000-memory.dmp
memory/4428-157-0x000001B9FF643000-0x000001B9FF645000-memory.dmp
memory/4428-156-0x000001B9FF640000-0x000001B9FF642000-memory.dmp
memory/4428-138-0x000001B9FD470000-0x000001B9FD472000-memory.dmp
memory/4428-149-0x000001B9FD470000-0x000001B9FD472000-memory.dmp
memory/4428-145-0x000001B9FD470000-0x000001B9FD472000-memory.dmp
memory/4428-142-0x000001B9FF450000-0x000001B9FF472000-memory.dmp
memory/4428-146-0x000001B9FD470000-0x000001B9FD472000-memory.dmp
memory/4428-144-0x000001B9FD470000-0x000001B9FD472000-memory.dmp
memory/4428-140-0x000001B9FD470000-0x000001B9FD472000-memory.dmp
memory/4428-176-0x000001B9FF646000-0x000001B9FF648000-memory.dmp
memory/4428-147-0x000001B9FF750000-0x000001B9FF7C6000-memory.dmp
memory/4428-148-0x000001B9FD470000-0x000001B9FD472000-memory.dmp