Analysis
-
max time kernel
48s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 10:38
Static task
static1
Behavioral task
behavioral1
Sample
Specification.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Specification.exe
Resource
win10v2004-20220414-en
General
-
Target
Specification.exe
-
Size
717KB
-
MD5
20796a16b1839afba1f87ed53e7bd841
-
SHA1
d5bd0d0efc2059dbbf1eaaa30b1c859c313d9250
-
SHA256
2d0474bfb8aced6c0aacc081936209dc9287827e20284160ceae3edca8a50184
-
SHA512
ad809362c428bdd0d30f56e4fe8f4bfd7960849575451b33c642d5fc7d424e7eb355ec3caba95f02040a80d505db4f04edf363dd7dbdbe79df94ccb22dbce09f
Malware Config
Signatures
-
Processes:
InstallUtil.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" InstallUtil.exe -
Processes:
InstallUtil.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" InstallUtil.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4.exe" iexplore.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
iexplore.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts iexplore.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
Specification.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ftirj = "\"C:\\Users\\Admin\\AppData\\Roaming\\Vcwewugzx\\Ftirj.exe\"" Specification.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4 = "C:\\Users\\Admin\\AppData\\Roaming\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4.exe" iexplore.exe -
Suspicious use of SetThreadContext 9 IoCs
Processes:
Specification.exeInstallUtil.exeiexplore.exedescription pid process target process PID 1960 set thread context of 2024 1960 Specification.exe InstallUtil.exe PID 2024 set thread context of 912 2024 InstallUtil.exe iexplore.exe PID 2024 set thread context of 1848 2024 InstallUtil.exe iexplore.exe PID 1848 set thread context of 1876 1848 iexplore.exe iexplore.exe PID 1848 set thread context of 608 1848 iexplore.exe iexplore.exe PID 1848 set thread context of 1940 1848 iexplore.exe iexplore.exe PID 1848 set thread context of 1648 1848 iexplore.exe iexplore.exe PID 1848 set thread context of 1164 1848 iexplore.exe iexplore.exe PID 1848 set thread context of 1820 1848 iexplore.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exeSpecification.exeInstallUtil.exepid process 756 powershell.exe 1960 Specification.exe 2024 InstallUtil.exe 2024 InstallUtil.exe 2024 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Specification.exepowershell.exeiexplore.exeiexplore.exedescription pid process Token: SeDebugPrivilege 1960 Specification.exe Token: SeDebugPrivilege 756 powershell.exe Token: SeDebugPrivilege 1848 iexplore.exe Token: SeDebugPrivilege 1876 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exeiexplore.exepid process 2024 InstallUtil.exe 1848 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Specification.exeInstallUtil.exeiexplore.exedescription pid process target process PID 1960 wrote to memory of 756 1960 Specification.exe powershell.exe PID 1960 wrote to memory of 756 1960 Specification.exe powershell.exe PID 1960 wrote to memory of 756 1960 Specification.exe powershell.exe PID 1960 wrote to memory of 756 1960 Specification.exe powershell.exe PID 1960 wrote to memory of 2024 1960 Specification.exe InstallUtil.exe PID 1960 wrote to memory of 2024 1960 Specification.exe InstallUtil.exe PID 1960 wrote to memory of 2024 1960 Specification.exe InstallUtil.exe PID 1960 wrote to memory of 2024 1960 Specification.exe InstallUtil.exe PID 1960 wrote to memory of 2024 1960 Specification.exe InstallUtil.exe PID 1960 wrote to memory of 2024 1960 Specification.exe InstallUtil.exe PID 1960 wrote to memory of 2024 1960 Specification.exe InstallUtil.exe PID 1960 wrote to memory of 2024 1960 Specification.exe InstallUtil.exe PID 1960 wrote to memory of 2024 1960 Specification.exe InstallUtil.exe PID 1960 wrote to memory of 2024 1960 Specification.exe InstallUtil.exe PID 1960 wrote to memory of 2024 1960 Specification.exe InstallUtil.exe PID 2024 wrote to memory of 912 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 912 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 912 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 912 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 912 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 912 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 912 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 912 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 912 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 1848 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 1848 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 1848 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 1848 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 1848 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 1848 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 1848 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 1848 2024 InstallUtil.exe iexplore.exe PID 2024 wrote to memory of 1848 2024 InstallUtil.exe iexplore.exe PID 1848 wrote to memory of 1876 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1876 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1876 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1876 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1876 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1876 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1876 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1876 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1876 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 608 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 608 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 608 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 608 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 608 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 608 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 608 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 608 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 608 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 608 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1940 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1940 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1940 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1940 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1940 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1940 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1940 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1940 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1940 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1940 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1648 1848 iexplore.exe iexplore.exe PID 1848 wrote to memory of 1648 1848 iexplore.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Specification.exe"C:\Users\Admin\AppData\Local\Temp\Specification.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- UAC bypass
- Windows security bypass
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵PID:912
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\lbtnimrnh0.txt"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\lbtnimrnh1.txt"4⤵
- Accesses Microsoft Outlook accounts
PID:608
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\lbtnimrnh2.txt"4⤵PID:1940
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\lbtnimrnh3.txt"4⤵PID:1648
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\lbtnimrnh4.txt"4⤵PID:1164
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\Y1F5W2I0-W6V4-G5S1-T8J1-U5Y8L0K337W4\lbtnimrnh4.txt"4⤵PID:1820
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84