Analysis
-
max time kernel
52s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 17:40
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.4166.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.AIDetectNet.01.4166.exe
Resource
win10v2004-20220414-en
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.4166.exe
-
Size
52KB
-
MD5
1f90ecea05ef9adfaa814d95a750f4ef
-
SHA1
71bfea6663dbfc06e228113e44723e91bf46f619
-
SHA256
4f3642f36e5ba22aec031ad20349200b39114fdb470b78247f1c1a5626146a87
-
SHA512
644696c4973d8ca08c8d054238688aa2a76ea97abe434608e77d82def125d714f21d59b8d35faceb80fdca52b6a0a580f7c1303c2c67fa65088df70c4d5d05cb
Malware Config
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.4166.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xhaienfx = "\"C:\\Users\\Admin\\AppData\\Roaming\\Vropvbhcy\\Xhaienfx.exe\"" SecuriteInfo.com.W32.AIDetectNet.01.4166.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.4166.exedescription pid process target process PID 1564 set thread context of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepowershell.exeSecuriteInfo.com.W32.AIDetectNet.01.4166.exepid process 2016 powershell.exe 1492 powershell.exe 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.4166.exepowershell.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe Token: SeDebugPrivilege 2016 powershell.exe Token: SeDebugPrivilege 1492 powershell.exe Token: SeDebugPrivilege 828 InstallUtil.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.4166.exedescription pid process target process PID 1564 wrote to memory of 2016 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 1564 wrote to memory of 2016 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 1564 wrote to memory of 2016 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 1564 wrote to memory of 2016 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 1564 wrote to memory of 1492 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 1564 wrote to memory of 1492 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 1564 wrote to memory of 1492 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 1564 wrote to memory of 1492 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 1564 wrote to memory of 828 1564 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4166.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4166.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5fa7a4fc5ee07259c7f464e3bdefeeaf8
SHA1d2c8d37aea971079390af3113ae8e213251390fe
SHA256bda987abe2c4dd0738080008d4d1ba6daf4c3768180673d7f97a1ff18f41b7ea
SHA512057cd2b2bb93c116f8eed43c465fac15436fde67193dcf571001e104dacc119a4e27c5154868942a2ee6047ad8a46f49620e31ccd8aa6fc0a2840de0887f8ebe
-
memory/828-72-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/828-70-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/828-77-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/828-74-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/828-73-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/828-69-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/828-75-0x0000000000429CFE-mapping.dmp
-
memory/828-79-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1492-67-0x0000000070410000-0x00000000709BB000-memory.dmpFilesize
5.7MB
-
memory/1492-68-0x0000000070410000-0x00000000709BB000-memory.dmpFilesize
5.7MB
-
memory/1492-64-0x0000000000000000-mapping.dmp
-
memory/1564-56-0x0000000005030000-0x00000000050AA000-memory.dmpFilesize
488KB
-
memory/1564-54-0x0000000000F30000-0x0000000000F42000-memory.dmpFilesize
72KB
-
memory/1564-58-0x0000000000E50000-0x0000000000E9C000-memory.dmpFilesize
304KB
-
memory/1564-55-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/1564-57-0x0000000000750000-0x0000000000790000-memory.dmpFilesize
256KB
-
memory/2016-62-0x00000000703F0000-0x000000007099B000-memory.dmpFilesize
5.7MB
-
memory/2016-63-0x00000000703F0000-0x000000007099B000-memory.dmpFilesize
5.7MB
-
memory/2016-61-0x00000000703F0000-0x000000007099B000-memory.dmpFilesize
5.7MB
-
memory/2016-59-0x0000000000000000-mapping.dmp