Analysis
- max time kernel
173s - max time network
182s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
19/03/2022, 19:59
Static task
static1
Behavioral task
behavioral1
Sample
0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe
- Size 15.0MB
- Sample220319-yqrfhahcdr
- SHA256 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628
- MD5 c8ad3f664039b9405f673569ffffda40
- SHA1 c5ca8781bf24b61190dd3bf83d477a87940a436f
- SHA512 5bf7378ee82c88007f260c5690bc25abe26cc8fc401510b4928f8bffcf02187c27ca2f4b1a89ce30be6a5a04bcab3b567971edef902863f4f209ba1bcca6cc6f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- DarkTrack Payload 4 IoCs
resource yara_rule behavioral2/memory/3340-135-0x0000000000400000-0x00000000004A8000-memory.dmp family_darktrack behavioral2/memory/3340-136-0x0000000000400000-0x00000000004A8000-memory.dmp family_darktrack behavioral2/memory/3340-137-0x0000000000400000-0x00000000004A8000-memory.dmp family_darktrack behavioral2/memory/1708-144-0x0000000000400000-0x00000000004A8000-memory.dmp family_darktrack - Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe\"" 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\java.exe\"" java.exe - Executes dropped EXE 2 IoCs
pid Process 4628 java.exe 1708 java.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe - Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\java.exe java.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\java.exe java.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe" 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe" 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Roaming\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java.exe = "C:\\Users\\Admin\\AppData\\Roaming\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java.exe = "C:\\Users\\Admin\\AppData\\Roaming\\java.exe" notepad.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1152 set thread context of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 4628 set thread context of 1708 4628 java.exe 90 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1708 java.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 1152 wrote to memory of 3340 1152 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 83 PID 3340 wrote to memory of 4732 3340 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 84 PID 3340 wrote to memory of 4732 3340 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 84 PID 3340 wrote to memory of 4732 3340 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 84 PID 3340 wrote to memory of 4628 3340 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 86 PID 3340 wrote to memory of 4628 3340 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 86 PID 3340 wrote to memory of 4628 3340 0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe 86 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 4628 wrote to memory of 1708 4628 java.exe 90 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91 PID 1708 wrote to memory of 4708 1708 java.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe"C:\Users\Admin\AppData\Local\Temp\0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe"C:\Users\Admin\AppData\Local\Temp\0c195f94b10c50e5cdc2a446dded220c29079901980a28019f6f59a990bbc628.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0C195F~1.EXE >> NUL3⤵PID:4732
-
-
C:\Users\Admin\AppData\Roaming\java.exe"C:\Users\Admin\AppData\Roaming\java.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Roaming\java.exe"C:\Users\Admin\AppData\Roaming\java.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵
- Adds Run key to start application
PID:4708
-
-
-
-