Analysis
-
max time kernel
152s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22/01/2022, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe
Resource
win10-en-20211208
General
-
Target
a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe
-
Size
455KB
-
MD5
601b14f244f7ff8d4a9ca45cec3a4d0c
-
SHA1
e247d7df8b88050a7345e108957c6b616c81fbe0
-
SHA256
a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a
-
SHA512
429f8c00669007a115a40e08672097d9340ab191e548a66c81d38cd315679ddef9ab7ddb4fad6e007ab8ffb09c9c1bb75ebeb4793092b9a99cd35d37e84b8c92
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe -
Deletes itself 1 IoCs
pid Process 420 cmd.exe -
Loads dropped DLL 4 IoCs
pid Process 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 968 taskmgr.exe 968 taskmgr.exe -
Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\davibot = "\\davibot\\davibot.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\davibot = "C:\\Users\\Admin\\AppData\\Local\\davibot\\davibot.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1056 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 968 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Token: SeDebugPrivilege 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Token: SeDebugPrivilege 968 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1632 wrote to memory of 268 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 27 PID 1632 wrote to memory of 268 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 27 PID 1632 wrote to memory of 268 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 27 PID 1632 wrote to memory of 268 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 27 PID 1632 wrote to memory of 420 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 28 PID 1632 wrote to memory of 420 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 28 PID 1632 wrote to memory of 420 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 28 PID 1632 wrote to memory of 420 1632 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 28 PID 268 wrote to memory of 968 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 29 PID 268 wrote to memory of 968 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 29 PID 268 wrote to memory of 968 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 29 PID 268 wrote to memory of 968 268 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 29 PID 420 wrote to memory of 1056 420 cmd.exe 31 PID 420 wrote to memory of 1056 420 cmd.exe 31 PID 420 wrote to memory of 1056 420 cmd.exe 31 PID 420 wrote to memory of 1056 420 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe"C:\Users\Admin\AppData\Local\Temp\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe"C:\Users\Admin\AppData\Local\Temp\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:968
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:1056
-
-