Analysis
-
max time kernel
358s -
max time network
406s -
platform
windows7_x64 -
resource
win7-20221111-es -
resource tags
arch:x64arch:x86image:win7-20221111-eslocale:es-esos:windows7-x64systemwindows -
submitted
01/12/2022, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe
Resource
win7-20221111-es
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe
Resource
win10v2004-20220812-es
windows10-2004-x64
12 signatures
300 seconds
General
-
Target
ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe
-
Size
330.6MB
-
MD5
fe79a9145f396e8b86a713d19f559d11
-
SHA1
4e1cc543ea89981a5bda109352a586fe5dedc41d
-
SHA256
2a896061202535d0e69bdd3152be87a3e7724e4123fc28c305ea3d549fca3010
-
SHA512
94d989b0340fcededf8b7620d2951328f7cb74c82530432ac869a43d2fff1c26ae28ffde4300a6c71c3498607203a04cce26a5883d0c08e8a4a38f860a18c01f
-
SSDEEP
98304:dmBKLVauUnoQgac+rReihrEN2xbhMJ8w23nZSGdGNGWWST6or:kBoVdh3+hrq2xsp23siYGWWQr
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1676 DjiFlightTekDriverncDrivingxBerny.exe -
Loads dropped DLL 1 IoCs
pid Process 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\SSLDivinateflexORL34WK = "cmd.exe /c start C:\\ProgramData\\DjiFlightTekDriverhDriv\\DjiFlightTekDriverncDrivingxBerny.exe" DjiFlightTekDriverncDrivingxBerny.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run DjiFlightTekDriverncDrivingxBerny.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\SSLDivinateflex1O13UP949 = "C:\\ProgramData\\DjiFlightTekDriverhDriv\\DjiFlightTekDriverncDrivingxBerny.exe" DjiFlightTekDriverncDrivingxBerny.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: DjiFlightTekDriverncDrivingxBerny.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ipinfo.io -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count DjiFlightTekDriverncDrivingxBerny.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 DjiFlightTekDriverncDrivingxBerny.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DjiFlightTekDriverncDrivingxBerny.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe 1676 DjiFlightTekDriverncDrivingxBerny.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: SeIncBasePriorityPrivilege 1676 DjiFlightTekDriverncDrivingxBerny.exe Token: 33 1676 DjiFlightTekDriverncDrivingxBerny.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 520 wrote to memory of 1540 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe 28 PID 520 wrote to memory of 1540 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe 28 PID 520 wrote to memory of 1540 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe 28 PID 520 wrote to memory of 1540 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe 28 PID 520 wrote to memory of 1676 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe 29 PID 520 wrote to memory of 1676 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe 29 PID 520 wrote to memory of 1676 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe 29 PID 520 wrote to memory of 1676 520 ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe"C:\Users\Admin\AppData\Local\Temp\ID-Arch_BTBMBCpdnyskuicdYKGQDZulurqjcmde.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1540
-
-
C:\ProgramData\DjiFlightTekDriverhDriv\DjiFlightTekDriverncDrivingxBerny.exe"C:\ProgramData\DjiFlightTekDriverhDriv\DjiFlightTekDriverncDrivingxBerny.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
555.0MB
MD505f0de642e9790a8e5b6ac401c30afbc
SHA1d53a80d9476dbbd419ea107c1fff1afd9f4ed77f
SHA2567651a684c4a23f0ee70afa54f897c5a9fda61b0845d15f21b784c0a96a6c8eaf
SHA5126f2edf95cb8461d38e2475172afa995128ce0a28688c2701cd5facc82bcf7c2ae64ad05c232a6cb230a305acc90885cc9c39fad09771204a94a5669c4e13e4a1
-
Filesize
555.0MB
MD505f0de642e9790a8e5b6ac401c30afbc
SHA1d53a80d9476dbbd419ea107c1fff1afd9f4ed77f
SHA2567651a684c4a23f0ee70afa54f897c5a9fda61b0845d15f21b784c0a96a6c8eaf
SHA5126f2edf95cb8461d38e2475172afa995128ce0a28688c2701cd5facc82bcf7c2ae64ad05c232a6cb230a305acc90885cc9c39fad09771204a94a5669c4e13e4a1
-
Filesize
555.0MB
MD505f0de642e9790a8e5b6ac401c30afbc
SHA1d53a80d9476dbbd419ea107c1fff1afd9f4ed77f
SHA2567651a684c4a23f0ee70afa54f897c5a9fda61b0845d15f21b784c0a96a6c8eaf
SHA5126f2edf95cb8461d38e2475172afa995128ce0a28688c2701cd5facc82bcf7c2ae64ad05c232a6cb230a305acc90885cc9c39fad09771204a94a5669c4e13e4a1