Analysis
-
max time kernel
152s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
24-09-2022 09:40
General
-
Target
HEUR-Trojan.MSIL.Agent.gen-fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997.exe
-
Size
555KB
-
MD5
2102422fdf58e1f1ea628e864576f437
-
SHA1
a071690fa220c12e9b5fa85e70dc3e7c42b30893
-
SHA256
fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997
-
SHA512
9894a54a6c85ce3e087ef6f2a6da1a5744d71667eaa8f17d23985e15c39a425cfe53f838875573e828170ce6d3756618c4b293e3d81dfc7a7a5570daf2c0c2b6
-
SSDEEP
12288:gfp3lxis8EdrQso5hnyRIAPQJno5hnyRIAQg:gfp36sN5snUPjnUQg
Malware Config
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 4 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Windows security modification 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Agent.gen-fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Agent.gen-fffc3cd304a280746276a3fa580a08f3de6aa2db4196c28ebd1c905607de0997.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\qntd4mxr.inf2⤵
-
C:\Windows\system32\cmd.execmd /c start C:\Windows\temp\w1uvcmam.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\w1uvcmam.exeC:\Windows\temp\w1uvcmam.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Modifies extensions of user files
- Windows security modification
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exe"cmd.exe"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Temp\w1uvcmam.exeFilesize
449KB
MD51db0b6b8d8429a19745386172720b241
SHA1bbe8ca48fecc9ee2e909a453e60bda1548b85898
SHA2560c903b0104a81695efd95240e79ba5d93cabae598acd193ac5f629d6ca10653d
SHA512e483213f1e64243a8f72b75dfca4dd6998122ddf08317849d4402d118dd39a5859e60cc880523573794809a06ef4b61a36c3113d80a289277828a5340042255e
-
C:\Windows\temp\qntd4mxr.infFilesize
583B
MD5762e7afd44f01f83bfdc484f5cfbd603
SHA1b5386d2bbd30c1df890be6ac594a2f614dd8e2b5
SHA256e36e1a5dbb962545a01c567dfa639b6d40dcdda8447f6193a658b8c474dcb8af
SHA51282118201c7100e2dda0a31e32443d766097f4017b626d0ab720efd15e7a7e7d7fde208df058c7d0299c53c75f3a65db329bec0613b454de6d8acb775fff42d29
-
C:\Windows\temp\w1uvcmam.exeFilesize
449KB
MD51db0b6b8d8429a19745386172720b241
SHA1bbe8ca48fecc9ee2e909a453e60bda1548b85898
SHA2560c903b0104a81695efd95240e79ba5d93cabae598acd193ac5f629d6ca10653d
SHA512e483213f1e64243a8f72b75dfca4dd6998122ddf08317849d4402d118dd39a5859e60cc880523573794809a06ef4b61a36c3113d80a289277828a5340042255e
-
\Users\Admin\AppData\Local\Temp\42bdbff4-2e20-4168-9b00-6137d5d5603f\AgileDotNetRT64.dllFilesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
memory/796-67-0x00000000005B0000-0x00000000005F2000-memory.dmpFilesize
264KB
-
memory/796-65-0x0000000000E80000-0x0000000000EF6000-memory.dmpFilesize
472KB
-
memory/796-63-0x0000000000000000-mapping.dmp
-
memory/944-59-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmpFilesize
8KB
-
memory/944-57-0x0000000000000000-mapping.dmp
-
memory/1048-61-0x00000000003D6000-0x00000000003F5000-memory.dmpFilesize
124KB
-
memory/1048-60-0x00000000003D6000-0x00000000003F5000-memory.dmpFilesize
124KB
-
memory/1048-54-0x0000000000C90000-0x0000000000D1E000-memory.dmpFilesize
568KB
-
memory/1048-56-0x000007FEF69E0000-0x000007FEF6B0C000-memory.dmpFilesize
1.2MB
-
memory/1732-68-0x0000000000000000-mapping.dmp
-
memory/1732-70-0x000007FEEB500000-0x000007FEEBF23000-memory.dmpFilesize
10.1MB
-
memory/1732-71-0x000007FEEA9A0000-0x000007FEEB4FD000-memory.dmpFilesize
11.4MB
-
memory/1732-72-0x00000000027E4000-0x00000000027E7000-memory.dmpFilesize
12KB
-
memory/1732-73-0x00000000027EB000-0x000000000280A000-memory.dmpFilesize
124KB
-
memory/1732-74-0x00000000027EB000-0x000000000280A000-memory.dmpFilesize
124KB
-
memory/1964-75-0x0000000000000000-mapping.dmp