Analysis
-
max time kernel
68s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 10:37
Static task
static1
Behavioral task
behavioral1
Sample
Specification.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Specification.exe
Resource
win10v2004-20220414-en
General
-
Target
Specification.exe
-
Size
717KB
-
MD5
20796a16b1839afba1f87ed53e7bd841
-
SHA1
d5bd0d0efc2059dbbf1eaaa30b1c859c313d9250
-
SHA256
2d0474bfb8aced6c0aacc081936209dc9287827e20284160ceae3edca8a50184
-
SHA512
ad809362c428bdd0d30f56e4fe8f4bfd7960849575451b33c642d5fc7d424e7eb355ec3caba95f02040a80d505db4f04edf363dd7dbdbe79df94ccb22dbce09f
Malware Config
Signatures
-
Processes:
InstallUtil.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" InstallUtil.exe -
Processes:
InstallUtil.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" InstallUtil.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4.exe" iexplore.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
iexplore.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts iexplore.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
iexplore.exeSpecification.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4.exe" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ftirj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Vcwewugzx\\Ftirj.exe\"" Specification.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4.exe" iexplore.exe -
Suspicious use of SetThreadContext 10 IoCs
Processes:
Specification.exeInstallUtil.exeiexplore.exedescription pid process target process PID 1472 set thread context of 1664 1472 Specification.exe InstallUtil.exe PID 1664 set thread context of 848 1664 InstallUtil.exe iexplore.exe PID 1664 set thread context of 884 1664 InstallUtil.exe iexplore.exe PID 1664 set thread context of 428 1664 InstallUtil.exe iexplore.exe PID 1664 set thread context of 268 1664 InstallUtil.exe iexplore.exe PID 268 set thread context of 1136 268 iexplore.exe iexplore.exe PID 268 set thread context of 324 268 iexplore.exe iexplore.exe PID 268 set thread context of 1996 268 iexplore.exe iexplore.exe PID 268 set thread context of 1096 268 iexplore.exe iexplore.exe PID 268 set thread context of 744 268 iexplore.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exeSpecification.exeInstallUtil.exepid process 1956 powershell.exe 1472 Specification.exe 1664 InstallUtil.exe 1664 InstallUtil.exe 1664 InstallUtil.exe 1664 InstallUtil.exe 1664 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Specification.exepowershell.exeiexplore.exeiexplore.exedescription pid process Token: SeDebugPrivilege 1472 Specification.exe Token: SeDebugPrivilege 1956 powershell.exe Token: SeDebugPrivilege 268 iexplore.exe Token: SeDebugPrivilege 1136 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exeiexplore.exepid process 1664 InstallUtil.exe 268 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Specification.exeInstallUtil.exeiexplore.exedescription pid process target process PID 1472 wrote to memory of 1956 1472 Specification.exe powershell.exe PID 1472 wrote to memory of 1956 1472 Specification.exe powershell.exe PID 1472 wrote to memory of 1956 1472 Specification.exe powershell.exe PID 1472 wrote to memory of 1956 1472 Specification.exe powershell.exe PID 1472 wrote to memory of 1664 1472 Specification.exe InstallUtil.exe PID 1472 wrote to memory of 1664 1472 Specification.exe InstallUtil.exe PID 1472 wrote to memory of 1664 1472 Specification.exe InstallUtil.exe PID 1472 wrote to memory of 1664 1472 Specification.exe InstallUtil.exe PID 1472 wrote to memory of 1664 1472 Specification.exe InstallUtil.exe PID 1472 wrote to memory of 1664 1472 Specification.exe InstallUtil.exe PID 1472 wrote to memory of 1664 1472 Specification.exe InstallUtil.exe PID 1472 wrote to memory of 1664 1472 Specification.exe InstallUtil.exe PID 1472 wrote to memory of 1664 1472 Specification.exe InstallUtil.exe PID 1472 wrote to memory of 1664 1472 Specification.exe InstallUtil.exe PID 1472 wrote to memory of 1664 1472 Specification.exe InstallUtil.exe PID 1664 wrote to memory of 848 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 848 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 848 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 848 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 848 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 848 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 848 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 848 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 848 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 884 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 884 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 884 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 884 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 884 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 884 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 884 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 884 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 884 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 428 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 428 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 428 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 428 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 428 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 428 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 428 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 428 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 428 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 268 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 268 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 268 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 268 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 268 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 268 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 268 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 268 1664 InstallUtil.exe iexplore.exe PID 1664 wrote to memory of 268 1664 InstallUtil.exe iexplore.exe PID 268 wrote to memory of 1136 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 1136 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 1136 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 1136 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 1136 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 1136 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 1136 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 1136 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 1136 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 324 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 324 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 324 268 iexplore.exe iexplore.exe PID 268 wrote to memory of 324 268 iexplore.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Specification.exe"C:\Users\Admin\AppData\Local\Temp\Specification.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- UAC bypass
- Windows security bypass
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\bqrqeitfj0.txt"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\bqrqeitfj1.txt"4⤵
- Accesses Microsoft Outlook accounts
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\bqrqeitfj2.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\bqrqeitfj3.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\bqrqeitfj4.txt"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\bqrqeitfj2.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\bqrqeitfj4.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/1472-54-0x0000000000C90000-0x0000000000D48000-memory.dmpFilesize
736KB
-
memory/1472-55-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB
-
memory/1472-56-0x0000000004B10000-0x0000000004BF0000-memory.dmpFilesize
896KB
-
memory/1472-57-0x0000000004270000-0x00000000042BC000-memory.dmpFilesize
304KB
-
memory/1664-69-0x00000000004010B8-mapping.dmp
-
memory/1664-63-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1664-64-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1664-66-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1664-68-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1664-74-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1664-75-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1956-62-0x000000006F5C0000-0x000000006FB6B000-memory.dmpFilesize
5.7MB
-
memory/1956-61-0x000000006F5C0000-0x000000006FB6B000-memory.dmpFilesize
5.7MB
-
memory/1956-60-0x000000006F5C0000-0x000000006FB6B000-memory.dmpFilesize
5.7MB
-
memory/1956-58-0x0000000000000000-mapping.dmp