Analysis
-
max time kernel
163s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 03:26
Static task
static1
Behavioral task
behavioral1
Sample
036de6e9928865caeced1bae00bdb55d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
036de6e9928865caeced1bae00bdb55d.exe
Resource
win10v2004-20221111-en
General
-
Target
036de6e9928865caeced1bae00bdb55d.exe
-
Size
96KB
-
MD5
036de6e9928865caeced1bae00bdb55d
-
SHA1
27b92bbc3cb16d06e645438079f24787975d520f
-
SHA256
a894e6dfcccc7112d8cab766fe285f2e45bf5d38021413b0e4ca1e9eb5992c48
-
SHA512
9bd1d4624d2fcda393c69b1e6dac21071ccdf3ea24c22e8b94a475a56131008f14acba099256fd59ceacd81e87c3d43d2e5f2d4966f7d9021b641b6c47af5adf
-
SSDEEP
1536:xfw6ygq47NGW9CgD4Vw8w28Dxv5s3wOXGpx/9l/7RyVcTIuGeNjcfgfu6ls5hfLu:xfw6Pq47NGW9lD4Vw8w28Dxv5s1XM+cN
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs
Processes:
reg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
Executes dropped EXE 2 IoCs
Processes:
scvhost.exewinmgmt.exepid process 1204 scvhost.exe 664 winmgmt.exe -
Drops startup file 1 IoCs
Processes:
036de6e9928865caeced1bae00bdb55d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exe 036de6e9928865caeced1bae00bdb55d.exe -
Loads dropped DLL 2 IoCs
Processes:
036de6e9928865caeced1bae00bdb55d.exepid process 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winmgmt.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Management = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\winmgmt.exe" winmgmt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
036de6e9928865caeced1bae00bdb55d.exewinmgmt.exescvhost.exepid process 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe 2040 036de6e9928865caeced1bae00bdb55d.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 664 winmgmt.exe 1204 scvhost.exe 664 winmgmt.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 1204 scvhost.exe 664 winmgmt.exe 1204 scvhost.exe 664 winmgmt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
036de6e9928865caeced1bae00bdb55d.exewinmgmt.exescvhost.exedescription pid process Token: SeDebugPrivilege 2040 036de6e9928865caeced1bae00bdb55d.exe Token: SeDebugPrivilege 664 winmgmt.exe Token: SeDebugPrivilege 1204 scvhost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
036de6e9928865caeced1bae00bdb55d.exescvhost.exewinmgmt.exedescription pid process target process PID 2040 wrote to memory of 1504 2040 036de6e9928865caeced1bae00bdb55d.exe reg.exe PID 2040 wrote to memory of 1504 2040 036de6e9928865caeced1bae00bdb55d.exe reg.exe PID 2040 wrote to memory of 1504 2040 036de6e9928865caeced1bae00bdb55d.exe reg.exe PID 2040 wrote to memory of 1504 2040 036de6e9928865caeced1bae00bdb55d.exe reg.exe PID 2040 wrote to memory of 1204 2040 036de6e9928865caeced1bae00bdb55d.exe scvhost.exe PID 2040 wrote to memory of 1204 2040 036de6e9928865caeced1bae00bdb55d.exe scvhost.exe PID 2040 wrote to memory of 1204 2040 036de6e9928865caeced1bae00bdb55d.exe scvhost.exe PID 2040 wrote to memory of 1204 2040 036de6e9928865caeced1bae00bdb55d.exe scvhost.exe PID 2040 wrote to memory of 664 2040 036de6e9928865caeced1bae00bdb55d.exe winmgmt.exe PID 2040 wrote to memory of 664 2040 036de6e9928865caeced1bae00bdb55d.exe winmgmt.exe PID 2040 wrote to memory of 664 2040 036de6e9928865caeced1bae00bdb55d.exe winmgmt.exe PID 2040 wrote to memory of 664 2040 036de6e9928865caeced1bae00bdb55d.exe winmgmt.exe PID 1204 wrote to memory of 1200 1204 scvhost.exe reg.exe PID 1204 wrote to memory of 1200 1204 scvhost.exe reg.exe PID 1204 wrote to memory of 1200 1204 scvhost.exe reg.exe PID 1204 wrote to memory of 1200 1204 scvhost.exe reg.exe PID 664 wrote to memory of 1156 664 winmgmt.exe reg.exe PID 664 wrote to memory of 1156 664 winmgmt.exe reg.exe PID 664 wrote to memory of 1156 664 winmgmt.exe reg.exe PID 664 wrote to memory of 1156 664 winmgmt.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\036de6e9928865caeced1bae00bdb55d.exe"C:\Users\Admin\AppData\Local\Temp\036de6e9928865caeced1bae00bdb55d.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t REG_DWORD /d 1 /f2⤵
- Modifies visibility of file extensions in Explorer
PID:1504 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t REG_DWORD /d 1 /f3⤵
- Modifies visibility of file extensions in Explorer
PID:1200 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winmgmt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winmgmt.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /t REG_DWORD /d 1 /f3⤵
- Modifies visibility of file extensions in Explorer
PID:1156
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exeFilesize
96KB
MD5036de6e9928865caeced1bae00bdb55d
SHA127b92bbc3cb16d06e645438079f24787975d520f
SHA256a894e6dfcccc7112d8cab766fe285f2e45bf5d38021413b0e4ca1e9eb5992c48
SHA5129bd1d4624d2fcda393c69b1e6dac21071ccdf3ea24c22e8b94a475a56131008f14acba099256fd59ceacd81e87c3d43d2e5f2d4966f7d9021b641b6c47af5adf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exeFilesize
96KB
MD5036de6e9928865caeced1bae00bdb55d
SHA127b92bbc3cb16d06e645438079f24787975d520f
SHA256a894e6dfcccc7112d8cab766fe285f2e45bf5d38021413b0e4ca1e9eb5992c48
SHA5129bd1d4624d2fcda393c69b1e6dac21071ccdf3ea24c22e8b94a475a56131008f14acba099256fd59ceacd81e87c3d43d2e5f2d4966f7d9021b641b6c47af5adf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winmgmt.exeFilesize
96KB
MD5036de6e9928865caeced1bae00bdb55d
SHA127b92bbc3cb16d06e645438079f24787975d520f
SHA256a894e6dfcccc7112d8cab766fe285f2e45bf5d38021413b0e4ca1e9eb5992c48
SHA5129bd1d4624d2fcda393c69b1e6dac21071ccdf3ea24c22e8b94a475a56131008f14acba099256fd59ceacd81e87c3d43d2e5f2d4966f7d9021b641b6c47af5adf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winmgmt.exeFilesize
96KB
MD5036de6e9928865caeced1bae00bdb55d
SHA127b92bbc3cb16d06e645438079f24787975d520f
SHA256a894e6dfcccc7112d8cab766fe285f2e45bf5d38021413b0e4ca1e9eb5992c48
SHA5129bd1d4624d2fcda393c69b1e6dac21071ccdf3ea24c22e8b94a475a56131008f14acba099256fd59ceacd81e87c3d43d2e5f2d4966f7d9021b641b6c47af5adf
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.exeFilesize
96KB
MD5036de6e9928865caeced1bae00bdb55d
SHA127b92bbc3cb16d06e645438079f24787975d520f
SHA256a894e6dfcccc7112d8cab766fe285f2e45bf5d38021413b0e4ca1e9eb5992c48
SHA5129bd1d4624d2fcda393c69b1e6dac21071ccdf3ea24c22e8b94a475a56131008f14acba099256fd59ceacd81e87c3d43d2e5f2d4966f7d9021b641b6c47af5adf
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\winmgmt.exeFilesize
96KB
MD5036de6e9928865caeced1bae00bdb55d
SHA127b92bbc3cb16d06e645438079f24787975d520f
SHA256a894e6dfcccc7112d8cab766fe285f2e45bf5d38021413b0e4ca1e9eb5992c48
SHA5129bd1d4624d2fcda393c69b1e6dac21071ccdf3ea24c22e8b94a475a56131008f14acba099256fd59ceacd81e87c3d43d2e5f2d4966f7d9021b641b6c47af5adf
-
memory/664-77-0x0000000074F70000-0x000000007551B000-memory.dmpFilesize
5.7MB
-
memory/664-75-0x0000000000455000-0x0000000000466000-memory.dmpFilesize
68KB
-
memory/664-65-0x0000000000000000-mapping.dmp
-
memory/664-73-0x0000000074F70000-0x000000007551B000-memory.dmpFilesize
5.7MB
-
memory/1156-70-0x0000000000000000-mapping.dmp
-
memory/1200-69-0x0000000000000000-mapping.dmp
-
memory/1204-74-0x0000000000C05000-0x0000000000C16000-memory.dmpFilesize
68KB
-
memory/1204-72-0x0000000074F70000-0x000000007551B000-memory.dmpFilesize
5.7MB
-
memory/1204-60-0x0000000000000000-mapping.dmp
-
memory/1204-76-0x0000000074F70000-0x000000007551B000-memory.dmpFilesize
5.7MB
-
memory/1204-78-0x0000000000C05000-0x0000000000C16000-memory.dmpFilesize
68KB
-
memory/1504-57-0x0000000000000000-mapping.dmp
-
memory/2040-55-0x0000000074F70000-0x000000007551B000-memory.dmpFilesize
5.7MB
-
memory/2040-56-0x0000000074F70000-0x000000007551B000-memory.dmpFilesize
5.7MB
-
memory/2040-71-0x0000000074F70000-0x000000007551B000-memory.dmpFilesize
5.7MB
-
memory/2040-54-0x00000000767B1000-0x00000000767B3000-memory.dmpFilesize
8KB
-
memory/2040-58-0x0000000000405000-0x0000000000416000-memory.dmpFilesize
68KB