Analysis
-
max time kernel
154s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
22/01/2022, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe
Resource
win10-en-20211208
General
-
Target
a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe
-
Size
455KB
-
MD5
601b14f244f7ff8d4a9ca45cec3a4d0c
-
SHA1
e247d7df8b88050a7345e108957c6b616c81fbe0
-
SHA256
a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a
-
SHA512
429f8c00669007a115a40e08672097d9340ab191e548a66c81d38cd315679ddef9ab7ddb4fad6e007ab8ffb09c9c1bb75ebeb4793092b9a99cd35d37e84b8c92
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe -
Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\davibot = "\\davibot\\davibot.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\davibot = "C:\\Users\\Admin\\AppData\\Local\\davibot\\davibot.exe" a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe File created C:\Windows\assembly\Desktop.ini a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe File opened for modification C:\Windows\assembly\Desktop.ini a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe File created C:\Windows\rescache\_merged\4183903823\97717462.pri Taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri Taskmgr.exe File opened for modification C:\Windows\assembly a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 808 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 3564 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Token: SeDebugPrivilege 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe Token: SeDebugPrivilege 3564 Taskmgr.exe Token: SeSystemProfilePrivilege 3564 Taskmgr.exe Token: SeCreateGlobalPrivilege 3564 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe 3564 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2708 wrote to memory of 1028 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 69 PID 2708 wrote to memory of 1028 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 69 PID 2708 wrote to memory of 1028 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 69 PID 2708 wrote to memory of 2304 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 70 PID 2708 wrote to memory of 2304 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 70 PID 2708 wrote to memory of 2304 2708 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 70 PID 2304 wrote to memory of 808 2304 cmd.exe 72 PID 2304 wrote to memory of 808 2304 cmd.exe 72 PID 2304 wrote to memory of 808 2304 cmd.exe 72 PID 1028 wrote to memory of 3564 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 73 PID 1028 wrote to memory of 3564 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 73 PID 1028 wrote to memory of 3564 1028 a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe"C:\Users\Admin\AppData\Local\Temp\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe"C:\Users\Admin\AppData\Local\Temp\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3564
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\a3fb704316fcbb49fb9182c619ebaa2243f3c2ccd6ee17b3c0bca587074c4c8a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:808
-
-