Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2022 06:41
Static task
static1
Behavioral task
behavioral1
Sample
66df4d837d9b6b60b845ef343b763bfb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
66df4d837d9b6b60b845ef343b763bfb.exe
Resource
win10v2004-20220812-en
General
-
Target
66df4d837d9b6b60b845ef343b763bfb.exe
-
Size
25KB
-
MD5
66df4d837d9b6b60b845ef343b763bfb
-
SHA1
f27a811445b649ff9a91da52152caf847ad38470
-
SHA256
ae1d5fd5d55bedc76554a13d0eee68ae8bb3e9af0cbf4fd3d1ae25e21bc1c1d3
-
SHA512
1f3258e69151f5fb0680ee02cc554d179092f00278dd54ab0dd75a987494ba75652d3c7f95925e5b25b95f0b4392663046d203b7fc58a2e54871a56899f2ff84
-
SSDEEP
768:svpUfE0bKP7eYkkrbiPs9Mvnv474hIScRj19dU2QW:QG9GP7eA2P5h0F19dU2QW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
Dllhost.exeServer.exeServer.exepid process 1684 Dllhost.exe 3432 Server.exe 3100 Server.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
66df4d837d9b6b60b845ef343b763bfb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\Control Panel\International\Geo\Nation 66df4d837d9b6b60b845ef343b763bfb.exe -
Drops startup file 2 IoCs
Processes:
Dllhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .." Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
66df4d837d9b6b60b845ef343b763bfb.exeDllhost.exepid process 1560 66df4d837d9b6b60b845ef343b763bfb.exe 1684 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
Dllhost.exedescription pid process Token: SeDebugPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe Token: 33 1684 Dllhost.exe Token: SeIncBasePriorityPrivilege 1684 Dllhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
66df4d837d9b6b60b845ef343b763bfb.exeDllhost.exedescription pid process target process PID 1560 wrote to memory of 1684 1560 66df4d837d9b6b60b845ef343b763bfb.exe Dllhost.exe PID 1560 wrote to memory of 1684 1560 66df4d837d9b6b60b845ef343b763bfb.exe Dllhost.exe PID 1684 wrote to memory of 1936 1684 Dllhost.exe schtasks.exe PID 1684 wrote to memory of 1936 1684 Dllhost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66df4d837d9b6b60b845ef343b763bfb.exe"C:\Users\Admin\AppData\Local\Temp\66df4d837d9b6b60b845ef343b763bfb.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dllhost.exe"C:\Users\Admin\AppData\Roaming\Dllhost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Server.exe.logFilesize
1KB
MD5a8a147915e3a996fdbe10b3a3f1e1bb2
SHA1abc564c1be468d57e700913e7b6cf8f62d421263
SHA2568b96a8557deea66696837af011843d6a82451ba57c8f9b5a2726a70818d6fc7e
SHA51217b42f17ef60a9f625703172763f692e5ed2ca93564a97853dfa72bb0ac6305ef3267aea0b205938e3aa8eac10156d9d4f322b30d0329d92d647bcec6372731c
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
25KB
MD566df4d837d9b6b60b845ef343b763bfb
SHA1f27a811445b649ff9a91da52152caf847ad38470
SHA256ae1d5fd5d55bedc76554a13d0eee68ae8bb3e9af0cbf4fd3d1ae25e21bc1c1d3
SHA5121f3258e69151f5fb0680ee02cc554d179092f00278dd54ab0dd75a987494ba75652d3c7f95925e5b25b95f0b4392663046d203b7fc58a2e54871a56899f2ff84
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
25KB
MD566df4d837d9b6b60b845ef343b763bfb
SHA1f27a811445b649ff9a91da52152caf847ad38470
SHA256ae1d5fd5d55bedc76554a13d0eee68ae8bb3e9af0cbf4fd3d1ae25e21bc1c1d3
SHA5121f3258e69151f5fb0680ee02cc554d179092f00278dd54ab0dd75a987494ba75652d3c7f95925e5b25b95f0b4392663046d203b7fc58a2e54871a56899f2ff84
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
25KB
MD566df4d837d9b6b60b845ef343b763bfb
SHA1f27a811445b649ff9a91da52152caf847ad38470
SHA256ae1d5fd5d55bedc76554a13d0eee68ae8bb3e9af0cbf4fd3d1ae25e21bc1c1d3
SHA5121f3258e69151f5fb0680ee02cc554d179092f00278dd54ab0dd75a987494ba75652d3c7f95925e5b25b95f0b4392663046d203b7fc58a2e54871a56899f2ff84
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
25KB
MD566df4d837d9b6b60b845ef343b763bfb
SHA1f27a811445b649ff9a91da52152caf847ad38470
SHA256ae1d5fd5d55bedc76554a13d0eee68ae8bb3e9af0cbf4fd3d1ae25e21bc1c1d3
SHA5121f3258e69151f5fb0680ee02cc554d179092f00278dd54ab0dd75a987494ba75652d3c7f95925e5b25b95f0b4392663046d203b7fc58a2e54871a56899f2ff84
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
25KB
MD566df4d837d9b6b60b845ef343b763bfb
SHA1f27a811445b649ff9a91da52152caf847ad38470
SHA256ae1d5fd5d55bedc76554a13d0eee68ae8bb3e9af0cbf4fd3d1ae25e21bc1c1d3
SHA5121f3258e69151f5fb0680ee02cc554d179092f00278dd54ab0dd75a987494ba75652d3c7f95925e5b25b95f0b4392663046d203b7fc58a2e54871a56899f2ff84
-
memory/1560-133-0x00007FF83BB10000-0x00007FF83C5D1000-memory.dmpFilesize
10.8MB
-
memory/1560-137-0x00007FF83BB10000-0x00007FF83C5D1000-memory.dmpFilesize
10.8MB
-
memory/1560-132-0x00000000001F0000-0x00000000001F8000-memory.dmpFilesize
32KB
-
memory/1684-140-0x00007FF83BB10000-0x00007FF83C5D1000-memory.dmpFilesize
10.8MB
-
memory/1684-138-0x00007FF83BB10000-0x00007FF83C5D1000-memory.dmpFilesize
10.8MB
-
memory/1684-134-0x0000000000000000-mapping.dmp
-
memory/1936-139-0x0000000000000000-mapping.dmp
-
memory/3100-147-0x00007FF83BB10000-0x00007FF83C5D1000-memory.dmpFilesize
10.8MB
-
memory/3100-148-0x00007FF83BB10000-0x00007FF83C5D1000-memory.dmpFilesize
10.8MB
-
memory/3432-143-0x00007FF83BB10000-0x00007FF83C5D1000-memory.dmpFilesize
10.8MB
-
memory/3432-144-0x00007FF83BB10000-0x00007FF83C5D1000-memory.dmpFilesize
10.8MB