Resubmissions
26-07-2022 07:12
220726-h1ld8sehcq 1024-02-2022 11:15
220224-nczjvachd8 802-08-2021 09:23
210802-dz94clans6 8Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
24-02-2022 11:15
Static task
static1
Behavioral task
behavioral1
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
-
Size
497KB
-
MD5
23595373d96bdbaf4a1361971aa96539
-
SHA1
020b0f179386a5ceee09e042ed7818ee42b2eba8
-
SHA256
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
-
SHA512
7e19addfec1ed3aa921f79c45a342e1ad5aa5db0483a2b9e54396335396e9c92545d8e49b4520ce562d1b786741bfceb940327acddbb020da87e93708bc5a783
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4520 mcinsupd.exe 4540 mcinsupd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe -
Loads dropped DLL 2 IoCs
pid Process 4520 mcinsupd.exe 4540 mcinsupd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\Run mcinsupd.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\McAfee VirusScan API Daily Update Module = "\"C:\\Users\\Admin\\McAfee VirusScan API Daily Update Module\\mcinsupd.exe\" 600 0" mcinsupd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\KET.FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 37003200460043004100430032004600420030003900320031004500410042000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1548 svchost.exe 1548 svchost.exe 1548 svchost.exe 1548 svchost.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 1548 svchost.exe 1548 svchost.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 1548 svchost.exe 1548 svchost.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 1548 svchost.exe 1548 svchost.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 1548 svchost.exe 1548 svchost.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 4844 rundll32.exe 1548 svchost.exe 1548 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1548 svchost.exe 4844 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4520 mcinsupd.exe Token: SeTcbPrivilege 4520 mcinsupd.exe Token: SeDebugPrivilege 4540 mcinsupd.exe Token: SeTcbPrivilege 4540 mcinsupd.exe Token: SeDebugPrivilege 1548 svchost.exe Token: SeTcbPrivilege 1548 svchost.exe Token: SeDebugPrivilege 4844 rundll32.exe Token: SeTcbPrivilege 4844 rundll32.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1756 wrote to memory of 4520 1756 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 82 PID 1756 wrote to memory of 4520 1756 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 82 PID 1756 wrote to memory of 4520 1756 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe 82 PID 4520 wrote to memory of 4540 4520 mcinsupd.exe 84 PID 4520 wrote to memory of 4540 4520 mcinsupd.exe 84 PID 4520 wrote to memory of 4540 4520 mcinsupd.exe 84 PID 4540 wrote to memory of 1548 4540 mcinsupd.exe 85 PID 4540 wrote to memory of 1548 4540 mcinsupd.exe 85 PID 4540 wrote to memory of 1548 4540 mcinsupd.exe 85 PID 4540 wrote to memory of 1548 4540 mcinsupd.exe 85 PID 4540 wrote to memory of 1548 4540 mcinsupd.exe 85 PID 4540 wrote to memory of 1548 4540 mcinsupd.exe 85 PID 4540 wrote to memory of 1548 4540 mcinsupd.exe 85 PID 4540 wrote to memory of 1548 4540 mcinsupd.exe 85 PID 1548 wrote to memory of 4844 1548 svchost.exe 93 PID 1548 wrote to memory of 4844 1548 svchost.exe 93 PID 1548 wrote to memory of 4844 1548 svchost.exe 93 PID 1548 wrote to memory of 4844 1548 svchost.exe 93 PID 1548 wrote to memory of 4844 1548 svchost.exe 93 PID 1548 wrote to memory of 4844 1548 svchost.exe 93 PID 1548 wrote to memory of 4844 1548 svchost.exe 93 PID 1548 wrote to memory of 4844 1548 svchost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe"C:\Users\Admin\McAfee VirusScan API Daily Update Module\mcinsupd.exe" 600 03⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 601 04⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe 609 15485⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
-
-
-