Resubmissions
26-07-2022 07:12
220726-h1ld8sehcq 1024-02-2022 11:15
220224-nczjvachd8 802-08-2021 09:23
210802-dz94clans6 8Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-02-2022 11:15
Static task
static1
Behavioral task
behavioral1
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
-
Size
497KB
-
MD5
23595373d96bdbaf4a1361971aa96539
-
SHA1
020b0f179386a5ceee09e042ed7818ee42b2eba8
-
SHA256
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
-
SHA512
7e19addfec1ed3aa921f79c45a342e1ad5aa5db0483a2b9e54396335396e9c92545d8e49b4520ce562d1b786741bfceb940327acddbb020da87e93708bc5a783
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 824 mcinsupd.exe 716 mcinsupd.exe -
Loads dropped DLL 6 IoCs
pid Process 1572 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 1572 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 1572 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 1572 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 824 mcinsupd.exe 716 mcinsupd.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files (x86)\McAfee VirusScan\mytilus3.dat mcinsupd.exe File opened for modification C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe mcinsupd.exe File created C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe mcinsupd.exe File opened for modification C:\Program Files (x86)\McAfee VirusScan mcinsupd.exe File opened for modification C:\Program Files (x86)\McAfee VirusScan\mytilus3.dll mcinsupd.exe File created C:\Program Files (x86)\McAfee VirusScan\mytilus3.dll mcinsupd.exe File opened for modification C:\Program Files (x86)\McAfee VirusScan\mytilus3.dat mcinsupd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\KET.FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 35004300310035004200350038003100460042003900320042003800410045000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1212 svchost.exe 1212 svchost.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1212 svchost.exe 1212 svchost.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1212 svchost.exe 1212 svchost.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1212 svchost.exe 1212 svchost.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1212 svchost.exe 1700 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 824 mcinsupd.exe Token: SeTcbPrivilege 824 mcinsupd.exe Token: SeDebugPrivilege 716 mcinsupd.exe Token: SeTcbPrivilege 716 mcinsupd.exe Token: SeDebugPrivilege 1212 svchost.exe Token: SeTcbPrivilege 1212 svchost.exe Token: SeDebugPrivilege 1700 rundll32.exe Token: SeTcbPrivilege 1700 rundll32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1572 wrote to memory of 824 1572 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 27 PID 1572 wrote to memory of 824 1572 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 27 PID 1572 wrote to memory of 824 1572 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 27 PID 1572 wrote to memory of 824 1572 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 27 PID 1572 wrote to memory of 824 1572 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 27 PID 1572 wrote to memory of 824 1572 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 27 PID 1572 wrote to memory of 824 1572 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 27 PID 716 wrote to memory of 1212 716 mcinsupd.exe 29 PID 716 wrote to memory of 1212 716 mcinsupd.exe 29 PID 716 wrote to memory of 1212 716 mcinsupd.exe 29 PID 716 wrote to memory of 1212 716 mcinsupd.exe 29 PID 716 wrote to memory of 1212 716 mcinsupd.exe 29 PID 716 wrote to memory of 1212 716 mcinsupd.exe 29 PID 716 wrote to memory of 1212 716 mcinsupd.exe 29 PID 716 wrote to memory of 1212 716 mcinsupd.exe 29 PID 716 wrote to memory of 1212 716 mcinsupd.exe 29 PID 1212 wrote to memory of 1700 1212 svchost.exe 30 PID 1212 wrote to memory of 1700 1212 svchost.exe 30 PID 1212 wrote to memory of 1700 1212 svchost.exe 30 PID 1212 wrote to memory of 1700 1212 svchost.exe 30 PID 1212 wrote to memory of 1700 1212 svchost.exe 30 PID 1212 wrote to memory of 1700 1212 svchost.exe 30 PID 1212 wrote to memory of 1700 1212 svchost.exe 30 PID 1212 wrote to memory of 1700 1212 svchost.exe 30 PID 1212 wrote to memory of 1700 1212 svchost.exe 30 PID 1212 wrote to memory of 1700 1212 svchost.exe 30 PID 1212 wrote to memory of 1700 1212 svchost.exe 30 PID 1212 wrote to memory of 1700 1212 svchost.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:824
-
-
C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe"C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe" 600 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 601 02⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe 609 12123⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-