Resubmissions
26-07-2022 07:12
220726-h1ld8sehcq 1024-02-2022 11:15
220224-nczjvachd8 802-08-2021 09:23
210802-dz94clans6 8Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-02-2022 11:15
Static task
static1
Behavioral task
behavioral1
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
-
Size
497KB
-
MD5
23595373d96bdbaf4a1361971aa96539
-
SHA1
020b0f179386a5ceee09e042ed7818ee42b2eba8
-
SHA256
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
-
SHA512
7e19addfec1ed3aa921f79c45a342e1ad5aa5db0483a2b9e54396335396e9c92545d8e49b4520ce562d1b786741bfceb940327acddbb020da87e93708bc5a783
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2184 mcinsupd.exe 3748 mcinsupd.exe -
Loads dropped DLL 2 IoCs
pid Process 2184 mcinsupd.exe 3748 mcinsupd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run mcinsupd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\McAfee VirusScan API Daily Update Module = "\"C:\\Users\\Admin\\McAfee VirusScan API Daily Update Module\\mcinsupd.exe\" 600 0" mcinsupd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\KET.FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 44003300430043003300360044003100320035003100390037003800420031000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3920 svchost.exe 3920 svchost.exe 3920 svchost.exe 3920 svchost.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 3920 svchost.exe 3920 svchost.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 3920 svchost.exe 3920 svchost.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 3920 svchost.exe 3920 svchost.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 3920 svchost.exe 3920 svchost.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 1112 rundll32.exe 3920 svchost.exe 3920 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3920 svchost.exe 1112 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2184 mcinsupd.exe Token: SeTcbPrivilege 2184 mcinsupd.exe Token: SeDebugPrivilege 3748 mcinsupd.exe Token: SeTcbPrivilege 3748 mcinsupd.exe Token: SeDebugPrivilege 3920 svchost.exe Token: SeTcbPrivilege 3920 svchost.exe Token: SeDebugPrivilege 1112 rundll32.exe Token: SeTcbPrivilege 1112 rundll32.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1840 wrote to memory of 2184 1840 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 69 PID 1840 wrote to memory of 2184 1840 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 69 PID 1840 wrote to memory of 2184 1840 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 69 PID 2184 wrote to memory of 3748 2184 mcinsupd.exe 71 PID 2184 wrote to memory of 3748 2184 mcinsupd.exe 71 PID 2184 wrote to memory of 3748 2184 mcinsupd.exe 71 PID 3748 wrote to memory of 3920 3748 mcinsupd.exe 72 PID 3748 wrote to memory of 3920 3748 mcinsupd.exe 72 PID 3748 wrote to memory of 3920 3748 mcinsupd.exe 72 PID 3748 wrote to memory of 3920 3748 mcinsupd.exe 72 PID 3748 wrote to memory of 3920 3748 mcinsupd.exe 72 PID 3748 wrote to memory of 3920 3748 mcinsupd.exe 72 PID 3748 wrote to memory of 3920 3748 mcinsupd.exe 72 PID 3748 wrote to memory of 3920 3748 mcinsupd.exe 72 PID 3920 wrote to memory of 1112 3920 svchost.exe 73 PID 3920 wrote to memory of 1112 3920 svchost.exe 73 PID 3920 wrote to memory of 1112 3920 svchost.exe 73 PID 3920 wrote to memory of 1112 3920 svchost.exe 73 PID 3920 wrote to memory of 1112 3920 svchost.exe 73 PID 3920 wrote to memory of 1112 3920 svchost.exe 73 PID 3920 wrote to memory of 1112 3920 svchost.exe 73 PID 3920 wrote to memory of 1112 3920 svchost.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe"C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe" 600 03⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 601 04⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe 609 39205⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
-
-