Analysis
-
max time kernel
154s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-04-2022 15:52
Behavioral task
behavioral1
Sample
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe
Resource
win7-20220414-en
General
-
Target
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe
-
Size
283KB
-
MD5
6bf6d7d7e70cd737716b614f9008417b
-
SHA1
0c1996ccb192acd5ead43954cc984480fb18d910
-
SHA256
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78
-
SHA512
6999c3f15f7b1c7231990f24c4dbae31ca9fb4faeddc337edfb5e6644f588ddcc103875d2746b7e3852bded61e8024cf2e5b41c1aef0ce05d5ba711c74474d33
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe" 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe -
Executes dropped EXE 1 IoCs
Processes:
system.exepid process 1056 system.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\system.exe upx \Users\Admin\AppData\Local\Temp\system.exe upx \Users\Admin\AppData\Local\Temp\system.exe upx C:\Users\Admin\AppData\Local\Temp\system.exe upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1188 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exepid process 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exesystem.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe" 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe" system.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
system.exepid process 1056 system.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exesystem.exedescription pid process Token: SeIncreaseQuotaPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeSecurityPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeTakeOwnershipPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeLoadDriverPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeSystemProfilePrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeSystemtimePrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeProfSingleProcessPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeIncBasePriorityPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeCreatePagefilePrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeBackupPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeRestorePrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeShutdownPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeDebugPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeSystemEnvironmentPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeChangeNotifyPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeRemoteShutdownPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeUndockPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeManageVolumePrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeImpersonatePrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeCreateGlobalPrivilege 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: 33 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: 34 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: 35 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeIncreaseQuotaPrivilege 1056 system.exe Token: SeSecurityPrivilege 1056 system.exe Token: SeTakeOwnershipPrivilege 1056 system.exe Token: SeLoadDriverPrivilege 1056 system.exe Token: SeSystemProfilePrivilege 1056 system.exe Token: SeSystemtimePrivilege 1056 system.exe Token: SeProfSingleProcessPrivilege 1056 system.exe Token: SeIncBasePriorityPrivilege 1056 system.exe Token: SeCreatePagefilePrivilege 1056 system.exe Token: SeBackupPrivilege 1056 system.exe Token: SeRestorePrivilege 1056 system.exe Token: SeShutdownPrivilege 1056 system.exe Token: SeDebugPrivilege 1056 system.exe Token: SeSystemEnvironmentPrivilege 1056 system.exe Token: SeChangeNotifyPrivilege 1056 system.exe Token: SeRemoteShutdownPrivilege 1056 system.exe Token: SeUndockPrivilege 1056 system.exe Token: SeManageVolumePrivilege 1056 system.exe Token: SeImpersonatePrivilege 1056 system.exe Token: SeCreateGlobalPrivilege 1056 system.exe Token: 33 1056 system.exe Token: 34 1056 system.exe Token: 35 1056 system.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
system.exepid process 1056 system.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.execmd.execmd.exesystem.exedescription pid process target process PID 1668 wrote to memory of 996 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1668 wrote to memory of 996 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1668 wrote to memory of 996 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1668 wrote to memory of 996 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1668 wrote to memory of 1408 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1668 wrote to memory of 1408 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1668 wrote to memory of 1408 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1668 wrote to memory of 1408 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1408 wrote to memory of 1320 1408 cmd.exe attrib.exe PID 1408 wrote to memory of 1320 1408 cmd.exe attrib.exe PID 1408 wrote to memory of 1320 1408 cmd.exe attrib.exe PID 1408 wrote to memory of 1320 1408 cmd.exe attrib.exe PID 996 wrote to memory of 1724 996 cmd.exe attrib.exe PID 996 wrote to memory of 1724 996 cmd.exe attrib.exe PID 996 wrote to memory of 1724 996 cmd.exe attrib.exe PID 996 wrote to memory of 1724 996 cmd.exe attrib.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1188 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1668 wrote to memory of 1056 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe system.exe PID 1668 wrote to memory of 1056 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe system.exe PID 1668 wrote to memory of 1056 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe system.exe PID 1668 wrote to memory of 1056 1668 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe system.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe PID 1056 wrote to memory of 1548 1056 system.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1724 attrib.exe 1320 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe"C:\Users\Admin\AppData\Local\Temp\9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
283KB
MD56bf6d7d7e70cd737716b614f9008417b
SHA10c1996ccb192acd5ead43954cc984480fb18d910
SHA2569a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78
SHA5126999c3f15f7b1c7231990f24c4dbae31ca9fb4faeddc337edfb5e6644f588ddcc103875d2746b7e3852bded61e8024cf2e5b41c1aef0ce05d5ba711c74474d33
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
283KB
MD56bf6d7d7e70cd737716b614f9008417b
SHA10c1996ccb192acd5ead43954cc984480fb18d910
SHA2569a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78
SHA5126999c3f15f7b1c7231990f24c4dbae31ca9fb4faeddc337edfb5e6644f588ddcc103875d2746b7e3852bded61e8024cf2e5b41c1aef0ce05d5ba711c74474d33
-
\Users\Admin\AppData\Local\Temp\system.exeFilesize
283KB
MD56bf6d7d7e70cd737716b614f9008417b
SHA10c1996ccb192acd5ead43954cc984480fb18d910
SHA2569a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78
SHA5126999c3f15f7b1c7231990f24c4dbae31ca9fb4faeddc337edfb5e6644f588ddcc103875d2746b7e3852bded61e8024cf2e5b41c1aef0ce05d5ba711c74474d33
-
\Users\Admin\AppData\Local\Temp\system.exeFilesize
283KB
MD56bf6d7d7e70cd737716b614f9008417b
SHA10c1996ccb192acd5ead43954cc984480fb18d910
SHA2569a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78
SHA5126999c3f15f7b1c7231990f24c4dbae31ca9fb4faeddc337edfb5e6644f588ddcc103875d2746b7e3852bded61e8024cf2e5b41c1aef0ce05d5ba711c74474d33
-
memory/996-55-0x0000000000000000-mapping.dmp
-
memory/1056-91-0x0000000000000000-mapping.dmp
-
memory/1188-57-0x0000000000000000-mapping.dmp
-
memory/1188-60-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1320-58-0x0000000000000000-mapping.dmp
-
memory/1408-56-0x0000000000000000-mapping.dmp
-
memory/1548-95-0x0000000000000000-mapping.dmp
-
memory/1668-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB
-
memory/1724-59-0x0000000000000000-mapping.dmp