Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 13:17
Behavioral task
behavioral1
Sample
06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
General
-
Target
06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe
-
Size
298KB
-
MD5
088c4646fe9a3691cac3a352e046baa7
-
SHA1
fb9216c1365d41d363cbcefb46e83d379cc8b706
-
SHA256
06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4
-
SHA512
2c54dc237ed7e775bc09fd7ab42b94f1a51bfb304c8ccb09f861f109414bebf235976947d06594cc0a3f45b68cb3d7493501dacd85f61868bf28470973e519c6
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYx:v6Wq4aaE6KwyF5L0Y2D1PqLY
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 3988 svhost.exe -
resource yara_rule behavioral2/files/0x0008000000022e34-133.dat upx behavioral2/files/0x0008000000022e34-134.dat upx behavioral2/memory/4648-135-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3988-136-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4648-137-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3988-138-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\f: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\j: svhost.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4648-135-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3988-136-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4648-137-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3988-138-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3988 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe 3988 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4648 wrote to memory of 3988 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 79 PID 4648 wrote to memory of 3988 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 79 PID 4648 wrote to memory of 3988 4648 06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe"C:\Users\Admin\AppData\Local\Temp\06c117392ec79cbca622e9c24bb1203023b3da20757aad02e9b5639edd804fb4.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3988
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD5d704934f8236bfd497c4f10398668be5
SHA17281ec4b4929512f293dab855d5e1ddc66a69707
SHA256e2376a07659c0af0b2bd1ddac5b8c2a6b9742fbd3d1f6a4a5049440a6cab7227
SHA5125153b983b571ed9f20440f33f3b535fff178fdb660b6b3f0fd09b630d53ad29804d2818e8f3a2e04ef582dbff96afe9befb972df3eabb8d4e6a9653a95f67cac
-
Filesize
298KB
MD5d704934f8236bfd497c4f10398668be5
SHA17281ec4b4929512f293dab855d5e1ddc66a69707
SHA256e2376a07659c0af0b2bd1ddac5b8c2a6b9742fbd3d1f6a4a5049440a6cab7227
SHA5125153b983b571ed9f20440f33f3b535fff178fdb660b6b3f0fd09b630d53ad29804d2818e8f3a2e04ef582dbff96afe9befb972df3eabb8d4e6a9653a95f67cac