Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-09-2022 09:40

General

  • Target

    2061b988ec7ce71209d99502da5b47337e005c81ca4b58aece0c7102a8e61351.exe

  • Size

    723KB

  • MD5

    58a4aeaa148dafee2028aeca0d10f442

  • SHA1

    9078f87630d05b410e585456b2ab5887a91fee72

  • SHA256

    2061b988ec7ce71209d99502da5b47337e005c81ca4b58aece0c7102a8e61351

  • SHA512

    e48b00ab03e0aa9921541cb4a7d05a31156f4fb30f508f974e49b6437fa75a31ec4ab1f7a0c891d3a2f23d0a155db811c75637fc2d35edc4672667329e8b7c79

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2061b988ec7ce71209d99502da5b47337e005c81ca4b58aece0c7102a8e61351.exe
    "C:\Users\Admin\AppData\Local\Temp\2061b988ec7ce71209d99502da5b47337e005c81ca4b58aece0c7102a8e61351.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3320
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:4696
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4224
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3940
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1884
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3572
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3412
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:4020
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4188
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:3368
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:4828
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:4940
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:2244
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:2228
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3784
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:2480
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:3872
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  4⤵
                  • Creates scheduled task(s)
                  PID:3524
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:2680
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:4684
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk1858" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:4260
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk1858" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:1240
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2388" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:4612
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2388" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:2160
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:1720
                        • C:\Windows\SysWOW64\schtasks.exe
                          SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          4⤵
                          • Creates scheduled task(s)
                          PID:2928
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4470" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                          PID:1792
                          • C:\Windows\SysWOW64\schtasks.exe
                            SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4470" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                            4⤵
                            • Creates scheduled task(s)
                            PID:1452
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5524" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3140
                          • C:\Windows\SysWOW64\schtasks.exe
                            SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5524" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                            4⤵
                            • Creates scheduled task(s)
                            PID:4768
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                          3⤵
                            PID:3592
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              4⤵
                                PID:1936
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                              3⤵
                                PID:4360
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 1251
                                  4⤵
                                    PID:3500
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                  3⤵
                                    PID:4660
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 1251
                                      4⤵
                                        PID:3760

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  915KB

                                  MD5

                                  a409fd1308d89d9b2cbf9f6e9b719f31

                                  SHA1

                                  72c18a464376629019982e8613ac308118873094

                                  SHA256

                                  a7f51496f2779e074ba9a7409da741810a76f927c4aff4d665279bccaa63d885

                                  SHA512

                                  af664fd3695e1dc2c1323053f09fcf22fce82538da5c1b567f04fc36f249e4c07c2f1e93e3504169cdff02304917fd8122e1622509983db02c665656221b55a3

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  915KB

                                  MD5

                                  a409fd1308d89d9b2cbf9f6e9b719f31

                                  SHA1

                                  72c18a464376629019982e8613ac308118873094

                                  SHA256

                                  a7f51496f2779e074ba9a7409da741810a76f927c4aff4d665279bccaa63d885

                                  SHA512

                                  af664fd3695e1dc2c1323053f09fcf22fce82538da5c1b567f04fc36f249e4c07c2f1e93e3504169cdff02304917fd8122e1622509983db02c665656221b55a3

                                • C:\ProgramData\HostData\logs.uce

                                  Filesize

                                  497B

                                  MD5

                                  13fda2ab01b83a5130842a5bab3892d3

                                  SHA1

                                  6e18e4b467cde054a63a95d4dfc030f156ecd215

                                  SHA256

                                  76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                  SHA512

                                  c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  3d086a433708053f9bf9523e1d87a4e8

                                  SHA1

                                  b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                  SHA256

                                  6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                  SHA512

                                  931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  7b6bf54905e878d919ea180f64dbb5a2

                                  SHA1

                                  e6232462b7f512ec1907381ce47d39bd6f4b21b8

                                  SHA256

                                  3d4f650f56f45339d41151e825b75ea7c8908dccd1dc36be0fe282c17d25183c

                                  SHA512

                                  5590e386c8e83d303f9c4e4fc0c1228485cff28d628a42ba8656f8ab0de3e0606ac24fdb4371ee964d363e4ec973f9044b4e1130397392144246f7813e8588c6

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  487343dbff79a847d98f884acda87c7d

                                  SHA1

                                  d2f9c19c55e089c2606802765f2f5481a03d2fab

                                  SHA256

                                  d169c477a82c8cd12b438f52128d78000c099cc3193fae26bb478d81169fccb3

                                  SHA512

                                  db93869ecbf36c91fa89f0ba7232a01ec5ab04d7de6f6bbee60c02979707f1f5b787333de95d03a4f992e3096d20bf80333dfdd6d9cf56504f95227f48fda1ef

                                • memory/1884-161-0x00000000703E0000-0x000000007042C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/3320-136-0x0000000004D50000-0x0000000004DB6000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/3320-132-0x00000000000A0000-0x0000000000148000-memory.dmp

                                  Filesize

                                  672KB

                                • memory/3320-135-0x0000000004B10000-0x0000000004B1A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/3320-134-0x0000000004B20000-0x0000000004BB2000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/3320-133-0x0000000005030000-0x00000000055D4000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/3572-165-0x0000000000420000-0x00000000004D0000-memory.dmp

                                  Filesize

                                  704KB

                                • memory/3940-158-0x00000000703E0000-0x000000007042C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/4224-146-0x00000000703E0000-0x000000007042C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/4224-141-0x0000000005980000-0x0000000005FA8000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/4224-150-0x0000000007A80000-0x0000000007A8A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/4224-151-0x0000000007CB0000-0x0000000007D46000-memory.dmp

                                  Filesize

                                  600KB

                                • memory/4224-152-0x0000000007C50000-0x0000000007C5E000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/4224-154-0x0000000007C90000-0x0000000007C98000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/4224-140-0x0000000003110000-0x0000000003146000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/4224-149-0x0000000007A30000-0x0000000007A4A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/4224-147-0x0000000006CB0000-0x0000000006CCE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4224-145-0x0000000006CD0000-0x0000000006D02000-memory.dmp

                                  Filesize

                                  200KB

                                • memory/4224-153-0x0000000007D50000-0x0000000007D6A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/4224-144-0x0000000006700000-0x000000000671E000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4224-143-0x0000000006020000-0x0000000006086000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4224-142-0x0000000005830000-0x0000000005852000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/4224-148-0x0000000008090000-0x000000000870A000-memory.dmp

                                  Filesize

                                  6.5MB