Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 15:42

General

  • Target

    647344e9c11ccd4789182594425c36611cea8c55317ae90755b63742c9f49518.exe

  • Size

    730KB

  • MD5

    b2cfbfab41a71b47fc7b1d2f24c1ec29

  • SHA1

    fd01fc088b49da7c0ca860b9db89242fd577ce8a

  • SHA256

    647344e9c11ccd4789182594425c36611cea8c55317ae90755b63742c9f49518

  • SHA512

    1009f5ad0761a52785c682dabe4d3835894673b8396bd4552d79704b8279a3fb495be2d133901c7c4a00e50e1a38125e33020993cfbbbeb05c88e3e4d500749c

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\647344e9c11ccd4789182594425c36611cea8c55317ae90755b63742c9f49518.exe
    "C:\Users\Admin\AppData\Local\Temp\647344e9c11ccd4789182594425c36611cea8c55317ae90755b63742c9f49518.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3128
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:208
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:344
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4720
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2420
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3644
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2268
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:216
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:636
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:220
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:4528
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                4⤵
                • Creates scheduled task(s)
                PID:2552
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:2192
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  4⤵
                  • Creates scheduled task(s)
                  PID:1912
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4484
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  4⤵
                  • Creates scheduled task(s)
                  PID:3784
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:4972
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:3868
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:4560
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:4796
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2337" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:5072
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2337" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:3832
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5233" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1916
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5233" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:1480
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:1660
                        • C:\Windows\SysWOW64\schtasks.exe
                          SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          4⤵
                          • Creates scheduled task(s)
                          PID:3732
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6648" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3204
                        • C:\Windows\SysWOW64\schtasks.exe
                          SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6648" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          4⤵
                          • Creates scheduled task(s)
                          PID:3548
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4612" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                          PID:3956
                          • C:\Windows\SysWOW64\schtasks.exe
                            SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4612" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                            4⤵
                            • Creates scheduled task(s)
                            PID:4192
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                          3⤵
                            PID:2168
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              4⤵
                                PID:976
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                              3⤵
                                PID:856
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 1251
                                  4⤵
                                    PID:4504
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                  3⤵
                                    PID:1880
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 1251
                                      4⤵
                                        PID:2204

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  943KB

                                  MD5

                                  936d1404bf11ef93c035f6c3911ef6be

                                  SHA1

                                  8a78a3ba707c33db32d1308e0e01897cdcc7b25f

                                  SHA256

                                  b8886cc4cdf985a17221e9c5b14fe01659571cba57f1ab8077c3d9332fbe10f2

                                  SHA512

                                  a73f10103675364f47ae6320a49f5b62143c3bb22359dbbfb571012f374f170b94e893935a75e3365a05f90549962e1ce5f9e521592777222eb3a8eb06f0a4d9

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  943KB

                                  MD5

                                  936d1404bf11ef93c035f6c3911ef6be

                                  SHA1

                                  8a78a3ba707c33db32d1308e0e01897cdcc7b25f

                                  SHA256

                                  b8886cc4cdf985a17221e9c5b14fe01659571cba57f1ab8077c3d9332fbe10f2

                                  SHA512

                                  a73f10103675364f47ae6320a49f5b62143c3bb22359dbbfb571012f374f170b94e893935a75e3365a05f90549962e1ce5f9e521592777222eb3a8eb06f0a4d9

                                • C:\ProgramData\HostData\logs.uce

                                  Filesize

                                  497B

                                  MD5

                                  13fda2ab01b83a5130842a5bab3892d3

                                  SHA1

                                  6e18e4b467cde054a63a95d4dfc030f156ecd215

                                  SHA256

                                  76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                  SHA512

                                  c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  968cb9309758126772781b83adb8a28f

                                  SHA1

                                  8da30e71accf186b2ba11da1797cf67f8f78b47c

                                  SHA256

                                  92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                  SHA512

                                  4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  1543c5f4e9f3b83de9edbd5fada01524

                                  SHA1

                                  e9aad6fe207ed489af6a3f6ba90c550dd97d89bf

                                  SHA256

                                  d8b37bf40cc51d05385c06acf42549227016607a27a86b63685303847d2691bc

                                  SHA512

                                  7c1dfda5eb1ba2bd53b4c7520f2733a46efa0cd36191906f7a18a5eac979bb60b8cbd5bb1076447d1a6eaa38e9dc95a3627c1a96cb3d123a7bcfdad11d8bce57

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  eb964e78535cf8cf0f4752fcd0a36074

                                  SHA1

                                  4e652465094522ae90fbb38768f249be69c804e7

                                  SHA256

                                  1fdbfc3f2446d8a4e0a3ebe4182c140b89a7eaefbdd36a1e908157b904e08506

                                  SHA512

                                  49416c577e25cd147f2099fcd4706efae73c2dcedb8f9ffebfd3c06a2ce5346cbc829526a8837d461bd87a35379eaf395be569409765720f4df69ff7903f4702

                                • memory/344-148-0x0000000007450000-0x0000000007ACA000-memory.dmp

                                  Filesize

                                  6.5MB

                                • memory/344-143-0x0000000005400000-0x0000000005466000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/344-144-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/344-145-0x0000000006AB0000-0x0000000006AE2000-memory.dmp

                                  Filesize

                                  200KB

                                • memory/344-146-0x0000000071000000-0x000000007104C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/344-147-0x0000000006060000-0x000000000607E000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/344-142-0x0000000004C00000-0x0000000004C22000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/344-149-0x0000000006DF0000-0x0000000006E0A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/344-150-0x0000000006E40000-0x0000000006E4A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/344-151-0x0000000007070000-0x0000000007106000-memory.dmp

                                  Filesize

                                  600KB

                                • memory/344-152-0x0000000007010000-0x000000000701E000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/344-153-0x0000000007110000-0x000000000712A000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/344-154-0x0000000007050000-0x0000000007058000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/344-140-0x0000000000B70000-0x0000000000BA6000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/344-141-0x0000000004D20000-0x0000000005348000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/2276-135-0x0000000004D50000-0x0000000004D5A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/2276-132-0x0000000000250000-0x00000000002F8000-memory.dmp

                                  Filesize

                                  672KB

                                • memory/2276-136-0x0000000004DF0000-0x0000000004E56000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/2276-133-0x0000000005180000-0x0000000005724000-memory.dmp

                                  Filesize

                                  5.6MB

                                • memory/2276-134-0x0000000004CB0000-0x0000000004D42000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/2420-161-0x0000000071000000-0x000000007104C000-memory.dmp

                                  Filesize

                                  304KB

                                • memory/3644-165-0x0000000000C30000-0x0000000000CE0000-memory.dmp

                                  Filesize

                                  704KB

                                • memory/4720-158-0x0000000071000000-0x000000007104C000-memory.dmp

                                  Filesize

                                  304KB