Analysis
- max time kernel
136s - max time network
190s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/01/2022, 18:59
Static task
static1
Behavioral task
behavioral1
Sample
abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe
- Size 496KB
- Sample220128-xnavasbdb7
- SHA256 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553
- MD5 f39e228cfdaf4abc6c505dcff60f8dc0
- SHA1 88337abf7b9ecd9396a384c4878e3e8674783101
- SHA512 cf3cd7b9dfd867702b7483dd3301e1da2fcd2bd2d7c0eee27cb7faff30c468e029a27816ded3cf01b3776d2157bd49d839dde2f17ec01b4c5d900d3637f8e415
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
- Executes dropped EXE 2 IoCs
pid Process 2128 wininit.exe 1012 wininit.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wininit.exe wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wininit.exe wininit.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" wininit.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\run wininit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Roaming\\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\\wininit.exe" wininit.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: wininit.exe File opened (read-only) \??\B: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\F: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\A: wininit.exe File opened (read-only) \??\B: wininit.exe File opened (read-only) \??\F: wininit.exe File opened (read-only) \??\M: wininit.exe File opened (read-only) \??\O: wininit.exe File opened (read-only) \??\A: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\O: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\K: wininit.exe File opened (read-only) \??\L: wininit.exe File opened (read-only) \??\Q: wininit.exe File opened (read-only) \??\U: wininit.exe File opened (read-only) \??\L: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\R: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\W: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\Y: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\R: wininit.exe File opened (read-only) \??\H: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\Z: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\S: wininit.exe File opened (read-only) \??\Z: wininit.exe File opened (read-only) \??\G: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\I: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\K: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\P: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\Q: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\N: wininit.exe File opened (read-only) \??\E: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\J: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\M: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\V: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\E: wininit.exe File opened (read-only) \??\X: wininit.exe File opened (read-only) \??\S: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\X: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\J: wininit.exe File opened (read-only) \??\P: wininit.exe File opened (read-only) \??\T: wininit.exe File opened (read-only) \??\Y: wininit.exe File opened (read-only) \??\N: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\T: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\U: abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe File opened (read-only) \??\G: wininit.exe File opened (read-only) \??\H: wininit.exe File opened (read-only) \??\I: wininit.exe File opened (read-only) \??\V: wininit.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3672 set thread context of 3168 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 70 PID 2128 set thread context of 1012 2128 wininit.exe 73 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe Token: SeCreatePagefilePrivilege 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe Token: SeShutdownPrivilege 2128 wininit.exe Token: SeCreatePagefilePrivilege 2128 wininit.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 3168 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 2128 wininit.exe 1012 wininit.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3672 wrote to memory of 3168 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 70 PID 3672 wrote to memory of 3168 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 70 PID 3672 wrote to memory of 3168 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 70 PID 3672 wrote to memory of 3168 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 70 PID 3672 wrote to memory of 3168 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 70 PID 3672 wrote to memory of 3168 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 70 PID 3672 wrote to memory of 3168 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 70 PID 3672 wrote to memory of 3168 3672 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 70 PID 3168 wrote to memory of 2128 3168 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 72 PID 3168 wrote to memory of 2128 3168 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 72 PID 3168 wrote to memory of 2128 3168 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 72 PID 2128 wrote to memory of 1012 2128 wininit.exe 73 PID 2128 wrote to memory of 1012 2128 wininit.exe 73 PID 2128 wrote to memory of 1012 2128 wininit.exe 73 PID 2128 wrote to memory of 1012 2128 wininit.exe 73 PID 2128 wrote to memory of 1012 2128 wininit.exe 73 PID 2128 wrote to memory of 1012 2128 wininit.exe 73 PID 2128 wrote to memory of 1012 2128 wininit.exe 73 PID 2128 wrote to memory of 1012 2128 wininit.exe 73 PID 3168 wrote to memory of 1520 3168 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 74 PID 3168 wrote to memory of 1520 3168 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 74 PID 3168 wrote to memory of 1520 3168 abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe 74 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe"C:\Users\Admin\AppData\Local\Temp\abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe"C:\Users\Admin\AppData\Local\Temp\abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Roaming\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\wininit.exeC:\Users\Admin\AppData\Roaming\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\wininit.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Roaming\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\wininit.exe"C:\Users\Admin\AppData\Roaming\com7.{1D2680C9-0E2A-469d-B787-065558BC7D43}\wininit.exe"4⤵
- Executes dropped EXE
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1012
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\120EED15.cmd3⤵PID:1520
-
-