Analysis
-
max time kernel
597s -
max time network
600s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-09-2022 06:55
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe
-
Size
922KB
-
MD5
2c3af67b622e7995777c91f9b64d37fa
-
SHA1
d63b0f44eff73bbfa2949a47c503d3fa1ff2a224
-
SHA256
db1446aa0758623a0dcebe15dd6742166f391ed938914b3e8339188b21513ebc
-
SHA512
4949e4ebadf894e3304c317e0b664b64056c7107f967f311df968dd6b4d198f6b6a3bea2b69197f4cb27d7d7f173374756a5129cb15fdecb57d91f4c921412b4
-
SSDEEP
12288:cd/yNU/TuF4sC0HuV/ldxf9eOBx0mLtOCyOeULosAj6yFiVC3nGv/Oj:wyOLuFEpV/nh9eM6fOeUU
Malware Config
Extracted
formbook
nhg6
FSZGb3Of7ECMIOG9mh1ql/w=
DAPP3Pm63eo+zg==
khOZTuClxYsKQsZALgy3ob9TFAk=
5uWol2f/RF3CAwFd
P70LqPOi2iE9g4vpPH1Lk8E0K6tC
KBRl7TSt3eo+zg==
rqedJWUJXKkDbORa
lpORtIg8lvMKbJ77PQW9kes=
Qinv+gsohAIooqyTcfUYgZ/IVxQ=
J0L2ggPAiE2gxm4=
r/I6qOGI5noJCghf
khJg6HKM6l9okVK+pg==
HRMTK/6p3eo+zg==
HqMiuv2JaKYJCghf
+FzGYtsGTpK46OkKkh5C
BBrOUpUY91R/r8gkPwrcuw==
klWfn2smdNcqog581h6vX7px
t8uvr7+R7IPaHSOH1hqvX7px
bHdghkj64OjzY2hOLa/WObrRkkeJjQ==
s3/smhoylh1J0mPS4aDHBDRyJw==
Eu3Z//8qkb4Pgnxjs7KvX7px
Du/M2tykfsrvKI21BL4=
PSM470DF9TZfxg==
g8+4SOr4WukPPHaaxWhV
Wp6eQXMJ4vcGbPvJGeO4K2cjEQM=
sUu3agUQbwZBjWbTrA==
cD2jpmsR7f74LQOoiG5H
3uWfnmL43kmM0eYKkh5C
D8hIaSK6nOYyvuwKkh5C
2jukR8PuW9opgKsne71aPJfpk2rYfuk6bQ==
8Kn8jxXXsvtDzvYKkh5C
PBS059Wedb7mSnjpPdLzU7s0K6tC
/RMCOf+e9YCnIxQSu2marA==
wkO7TZc1jPoLNcOp4vUglpKzLw==
0IEGMPKlhU2gxm4=
2T8RCBr43vVVaf5I
fljAttGHXHWMq8RIqzxMpxG/r+LsFTk=
/og98Tea9nueONlLQD2egqUdkAs=
DakWt1Bc6TFTzA==
h1O9avS4iE2gxm4=
uu4WRzneVStU1w==
LsZmJl8YeP5Vaf5I
nHdkkYug/oK87Hcp0JSQyxC7qOLsFTk=
2oURQhXaNMIXkEcjayLqQmcjEQM=
NfVyM2uD3eo+zg==
nT20ZP8fheL5IiV4xhqvX7px
dbeCkGH4309r5gp24CCvX7px
72jolSNVrfj/NBu/Bn/evQ==
jGtO0Rey6DhVmKwRUtGvX7px
RPd7qXExmzSGlZHVuw==
X70pwhG0S4qZv2w=
9xPzBiP3SNEaU1KuDFRMtE3fYMons6VE
gXVziEtEmsbg/SeBwQGIoKj8tK01jw==
+B9xAkQQb+wSkhl/T08gEjAs9IugoA9I
KMgonCDitr/U/aiSc/bZdfnSjepK
belockUJb/okrNEwgBdDjsA0K6tC
FGDUFuN9k03/08Ks/bw=
nRGNPr25BpzvAXbgwJJK
7awA/seC0Uhr3dLAHB1ql/w=
glK6Uc2Mzma3/E196bQ=
O4Jwj11Xqv9IjWbTrA==
s++5zMnzj8z2aWY=
eJN2bFImkiB4xOAKkh5C
xsaRhotGVStU1w==
liuhejing.org
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
msdt.exepid process 1748 msdt.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exeRegSvcs.exemsdt.exedescription pid process target process PID 1076 set thread context of 560 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe RegSvcs.exe PID 560 set thread context of 1260 560 RegSvcs.exe Explorer.EXE PID 560 set thread context of 1260 560 RegSvcs.exe Explorer.EXE PID 1748 set thread context of 1260 1748 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
msdt.exedescription ioc process Key created \Registry\User\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exeRegSvcs.exepowershell.exemsdt.exepid process 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe 560 RegSvcs.exe 1396 powershell.exe 560 RegSvcs.exe 560 RegSvcs.exe 560 RegSvcs.exe 560 RegSvcs.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
RegSvcs.exemsdt.exepid process 560 RegSvcs.exe 560 RegSvcs.exe 560 RegSvcs.exe 560 RegSvcs.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe 1748 msdt.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exepowershell.exeRegSvcs.exemsdt.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe Token: SeDebugPrivilege 1396 powershell.exe Token: SeDebugPrivilege 560 RegSvcs.exe Token: SeDebugPrivilege 1748 msdt.exe Token: SeShutdownPrivilege 1260 Explorer.EXE Token: SeShutdownPrivilege 1260 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exeRegSvcs.exemsdt.exedescription pid process target process PID 1076 wrote to memory of 1396 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe powershell.exe PID 1076 wrote to memory of 1396 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe powershell.exe PID 1076 wrote to memory of 1396 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe powershell.exe PID 1076 wrote to memory of 1396 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe powershell.exe PID 1076 wrote to memory of 1432 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe schtasks.exe PID 1076 wrote to memory of 1432 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe schtasks.exe PID 1076 wrote to memory of 1432 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe schtasks.exe PID 1076 wrote to memory of 1432 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe schtasks.exe PID 1076 wrote to memory of 560 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe RegSvcs.exe PID 1076 wrote to memory of 560 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe RegSvcs.exe PID 1076 wrote to memory of 560 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe RegSvcs.exe PID 1076 wrote to memory of 560 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe RegSvcs.exe PID 1076 wrote to memory of 560 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe RegSvcs.exe PID 1076 wrote to memory of 560 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe RegSvcs.exe PID 1076 wrote to memory of 560 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe RegSvcs.exe PID 1076 wrote to memory of 560 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe RegSvcs.exe PID 1076 wrote to memory of 560 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe RegSvcs.exe PID 1076 wrote to memory of 560 1076 SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe RegSvcs.exe PID 560 wrote to memory of 1748 560 RegSvcs.exe msdt.exe PID 560 wrote to memory of 1748 560 RegSvcs.exe msdt.exe PID 560 wrote to memory of 1748 560 RegSvcs.exe msdt.exe PID 560 wrote to memory of 1748 560 RegSvcs.exe msdt.exe PID 1748 wrote to memory of 1672 1748 msdt.exe Firefox.exe PID 1748 wrote to memory of 1672 1748 msdt.exe Firefox.exe PID 1748 wrote to memory of 1672 1748 msdt.exe Firefox.exe PID 1748 wrote to memory of 1672 1748 msdt.exe Firefox.exe PID 1748 wrote to memory of 1672 1748 msdt.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.Kryptik.AGMJ.tr.27252.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZWLXkesmLC.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZWLXkesmLC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA9A8.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"4⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA9A8.tmpFilesize
1KB
MD541b125bc1b181b3154e57139e9d20098
SHA102acbb1c01826d9940308c885274af8d48113160
SHA256fe2aafe5a35683f959d6ca84e83f189942e34490546aebaace1f0d3680c4101e
SHA5124a1be9f8fcd0ec81466ded35b1c32026170eeee6be79f07731336afae33d19c1996a776bf5b5bff9b5555352f93eec2497611ac46c88be9c247f3d3432e678b0
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
1.0MB
MD5f1e5f58f9eb43ecec773acbdb410b888
SHA1f1b8076b0bbde696694bbc0ab259a77893839464
SHA256a15fd84ee61b54c92bb099dfb78226548f43d550c67fb6adf4cce3d064ab1c14
SHA5120aff96430dd99bb227285fefc258014c301f85216c84e40f45702d26cdd7e77261a41fd3811d686f5fb2ee363cc651a014e8ffa339384004cece645a36486456
-
memory/560-73-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/560-71-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/560-85-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/560-75-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/560-83-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/560-80-0x00000000001C0000-0x00000000001D0000-memory.dmpFilesize
64KB
-
memory/560-74-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/560-76-0x00000000000C0000-0x00000000000D0000-memory.dmpFilesize
64KB
-
memory/560-65-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/560-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/560-69-0x00000000004012B0-mapping.dmp
-
memory/560-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1076-64-0x00000000048D0000-0x0000000004904000-memory.dmpFilesize
208KB
-
memory/1076-54-0x0000000000970000-0x0000000000A5C000-memory.dmpFilesize
944KB
-
memory/1076-56-0x00000000004E0000-0x00000000004F4000-memory.dmpFilesize
80KB
-
memory/1076-59-0x0000000005FC0000-0x000000000604E000-memory.dmpFilesize
568KB
-
memory/1076-57-0x00000000005F0000-0x0000000000604000-memory.dmpFilesize
80KB
-
memory/1076-55-0x0000000075C51000-0x0000000075C53000-memory.dmpFilesize
8KB
-
memory/1076-58-0x00000000006F0000-0x00000000006FC000-memory.dmpFilesize
48KB
-
memory/1260-77-0x0000000006850000-0x0000000006970000-memory.dmpFilesize
1.1MB
-
memory/1260-92-0x00000000040D0000-0x00000000041D0000-memory.dmpFilesize
1024KB
-
memory/1260-90-0x00000000040D0000-0x00000000041D0000-memory.dmpFilesize
1024KB
-
memory/1260-81-0x0000000006C90000-0x0000000006DAB000-memory.dmpFilesize
1.1MB
-
memory/1396-60-0x0000000000000000-mapping.dmp
-
memory/1396-78-0x000000006E550000-0x000000006EAFB000-memory.dmpFilesize
5.7MB
-
memory/1396-72-0x000000006E550000-0x000000006EAFB000-memory.dmpFilesize
5.7MB
-
memory/1432-61-0x0000000000000000-mapping.dmp
-
memory/1748-82-0x0000000000000000-mapping.dmp
-
memory/1748-86-0x0000000000F30000-0x0000000001024000-memory.dmpFilesize
976KB
-
memory/1748-87-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1748-88-0x0000000002430000-0x0000000002733000-memory.dmpFilesize
3.0MB
-
memory/1748-89-0x00000000009D0000-0x0000000000A5F000-memory.dmpFilesize
572KB
-
memory/1748-91-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB