Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2022 23:51

General

  • Target

    37a914abd6a7c6db37a751a9b1b5f67d47c0d4d48c4ac54b65880be0bd384e55.exe

  • Size

    723KB

  • MD5

    4661c78ac51a572c780a5caccf8653d4

  • SHA1

    41b5ba1b5181aefd5778c62bfe0eb71f745b687b

  • SHA256

    37a914abd6a7c6db37a751a9b1b5f67d47c0d4d48c4ac54b65880be0bd384e55

  • SHA512

    2acb987326b0e7f6857257ef857ea6b13d0d5eb44d65797379b6bbc8c085de80de6ca45a6d03bf338dddf309d5ad7882a213252f2be21c4bced99b6409fab04e

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37a914abd6a7c6db37a751a9b1b5f67d47c0d4d48c4ac54b65880be0bd384e55.exe
    "C:\Users\Admin\AppData\Local\Temp\37a914abd6a7c6db37a751a9b1b5f67d47c0d4d48c4ac54b65880be0bd384e55.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3204
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:4992
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4900
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:632
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3404
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2864
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2360
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:424
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2680
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:3844
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2392
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:1612
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2772
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:2588
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:2544
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:4440
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:3068
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:4604
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  4⤵
                  • Creates scheduled task(s)
                  PID:3084
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:4504
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:4560
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6712" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:2876
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6712" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:3512
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk990" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:3840
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk990" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:1544
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2195" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:4564
                        • C:\Windows\SysWOW64\schtasks.exe
                          SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2195" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          4⤵
                          • Creates scheduled task(s)
                          PID:4700
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk2142" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                          PID:640
                          • C:\Windows\SysWOW64\schtasks.exe
                            SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk2142" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                            4⤵
                            • Creates scheduled task(s)
                            PID:1156
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                          3⤵
                            PID:4624
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              4⤵
                                PID:4400
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                              3⤵
                                PID:4884
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 1251
                                  4⤵
                                    PID:1648
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                  3⤵
                                    PID:2932
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 1251
                                      4⤵
                                        PID:4392

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  914KB

                                  MD5

                                  bb988050cd88cf183a9d17fb51e59c96

                                  SHA1

                                  6fedd9afdb862af99efcc47030006820c32417e1

                                  SHA256

                                  a599ff5edd235b4ab2bdfdf08c7bb0ff5ebac39894d3d687c6c0a4d11946e94d

                                  SHA512

                                  bf3ae7f9aac1273864f52199a90eeb6d513bb04c0ce8b4856480996552a27cf428644de167bfe7bbeff4235231a2543d85e095c92bd76fd2af3007e77b9a165d

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  914KB

                                  MD5

                                  bb988050cd88cf183a9d17fb51e59c96

                                  SHA1

                                  6fedd9afdb862af99efcc47030006820c32417e1

                                  SHA256

                                  a599ff5edd235b4ab2bdfdf08c7bb0ff5ebac39894d3d687c6c0a4d11946e94d

                                  SHA512

                                  bf3ae7f9aac1273864f52199a90eeb6d513bb04c0ce8b4856480996552a27cf428644de167bfe7bbeff4235231a2543d85e095c92bd76fd2af3007e77b9a165d

                                • C:\ProgramData\HostData\logs.uce

                                  Filesize

                                  497B

                                  MD5

                                  13fda2ab01b83a5130842a5bab3892d3

                                  SHA1

                                  6e18e4b467cde054a63a95d4dfc030f156ecd215

                                  SHA256

                                  76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                  SHA512

                                  c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  968cb9309758126772781b83adb8a28f

                                  SHA1

                                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                                  SHA256

                                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                  SHA512

                                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  7931d0a07de480eed7910a4e79150468

                                  SHA1

                                  7626ce261239dd15b358227e9dc50f0cb6012cd8

                                  SHA256

                                  68990dbf08140277c533bffa63b4c3e3418959bb1ca7eb28db8f5faced5203bb

                                  SHA512

                                  478558e59c7d81bc564ef2642898b139a8669f2b9bd09a45852cd922fd36a3bb6930cb6abe129fc82d13cbfd14193e9a55aae87d79531edbfe15402ec652756d

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  95cbe21c33bb77b86a7711179c96eeed

                                  SHA1

                                  6bb02e947155b95e47a891eabeacc9b12908acc1

                                  SHA256

                                  aa65ae1adaf3aa84ba5f20917f0aee4906a4f64da50d7cb50effd10f29a7091e

                                  SHA512

                                  9c74c7514970c2a8b273435393b23fa080379574f8879704214a64d9be5841d68eb601b328e3a40db07ac35cce884b592b5f78f96ab2d259ab75a015b35cf9eb

                                • memory/424-179-0x0000000000000000-mapping.dmp

                                • memory/632-158-0x00000000705D0000-0x000000007061C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/632-155-0x0000000000000000-mapping.dmp

                                • memory/640-177-0x0000000000000000-mapping.dmp

                                • memory/1156-184-0x0000000000000000-mapping.dmp

                                • memory/1544-186-0x0000000000000000-mapping.dmp

                                • memory/1612-181-0x0000000000000000-mapping.dmp

                                • memory/1648-192-0x0000000000000000-mapping.dmp

                                • memory/2360-166-0x0000000000000000-mapping.dmp

                                • memory/2392-168-0x0000000000000000-mapping.dmp

                                • memory/2544-170-0x0000000000000000-mapping.dmp

                                • memory/2588-180-0x0000000000000000-mapping.dmp

                                • memory/2680-167-0x0000000000000000-mapping.dmp

                                • memory/2772-169-0x0000000000000000-mapping.dmp

                                • memory/2864-164-0x0000000000950000-0x0000000000A00000-memory.dmp

                                  Filesize

                                  704KB

                                • memory/2864-161-0x0000000000000000-mapping.dmp

                                • memory/2876-174-0x0000000000000000-mapping.dmp

                                • memory/2932-193-0x0000000000000000-mapping.dmp

                                • memory/3068-182-0x0000000000000000-mapping.dmp

                                • memory/3084-185-0x0000000000000000-mapping.dmp

                                • memory/3204-137-0x0000000000000000-mapping.dmp

                                • memory/3404-165-0x00000000705D0000-0x000000007061C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/3404-159-0x0000000000000000-mapping.dmp

                                • memory/3512-183-0x0000000000000000-mapping.dmp

                                • memory/3840-175-0x0000000000000000-mapping.dmp

                                • memory/3844-178-0x0000000000000000-mapping.dmp

                                • memory/4392-194-0x0000000000000000-mapping.dmp

                                • memory/4400-190-0x0000000000000000-mapping.dmp

                                • memory/4440-171-0x0000000000000000-mapping.dmp

                                • memory/4504-173-0x0000000000000000-mapping.dmp

                                • memory/4564-176-0x0000000000000000-mapping.dmp

                                • memory/4604-172-0x0000000000000000-mapping.dmp

                                • memory/4624-189-0x0000000000000000-mapping.dmp

                                • memory/4700-187-0x0000000000000000-mapping.dmp

                                • memory/4884-191-0x0000000000000000-mapping.dmp

                                • memory/4900-148-0x0000000007960000-0x0000000007FDA000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/4900-143-0x0000000005760000-0x00000000057C6000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4900-146-0x00000000705D0000-0x000000007061C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/4900-149-0x0000000007300000-0x000000000731A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/4900-145-0x0000000006FA0000-0x0000000006FD2000-memory.dmp

                                  Filesize

                                  200KB

                                • memory/4900-154-0x0000000007560000-0x0000000007568000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/4900-144-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4900-147-0x0000000006560000-0x000000000657E000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4900-142-0x0000000004EF0000-0x0000000004F12000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/4900-141-0x0000000005080000-0x00000000056A8000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/4900-140-0x0000000004A10000-0x0000000004A46000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/4900-139-0x0000000000000000-mapping.dmp

                                • memory/4900-150-0x0000000007350000-0x000000000735A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/4900-151-0x0000000007580000-0x0000000007616000-memory.dmp

                                  Filesize

                                  600KB

                                • memory/4900-152-0x0000000007520000-0x000000000752E000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/4900-153-0x0000000007620000-0x000000000763A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/4976-132-0x0000000000080000-0x0000000000128000-memory.dmp

                                  Filesize

                                  672KB

                                • memory/4976-135-0x0000000004B80000-0x0000000004B8A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/4976-136-0x0000000004DA0000-0x0000000004E06000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4976-134-0x0000000004AD0000-0x0000000004B62000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/4976-133-0x0000000004FA0000-0x0000000005544000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/4992-138-0x0000000000000000-mapping.dmp