aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf

Analysis

max time kernel
156s
max time network
187s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf.exe
Size

710KB
MD5

413cd7a56e1efb382c26f80f72cdb42d
SHA1

d6221156ba019ecf8739775ae09fbad7889e20ee
SHA256

aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf
SHA512

59b43c5ec3461c36f612eba24ab5b9ff0703f98dc090c6915bdc371f6f866a62d39d6b20ae2eae27f1ee06831f173839a1b7d54858354883aea1417c12ae374a
SSDEEP

12288:hp0aUZq6gKoYW9hUVKOwdk6e/GTElxqbbCir2QwofboRILsw7rSsUAo:hCTZ9q9hMqU/OmK12YMRw

Score

9^/10

evasion persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1184	bcdedit.exe
1060	bcdedit.exe
1792	bcdedit.exe
592	bcdedit.exe
1428	bcdedit.exe
736	bcdedit.exe
1588	bcdedit.exe
1552	bcdedit.exe
1464	bcdedit.exe
1980	bcdedit.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\6d91b6.sys	naryt.exe

Executes dropped EXE 1 IoCs

pid	Process
1124	naryt.exe

Deletes itself 1 IoCs

pid	Process
1220	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1868	aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	naryt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Naryt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Eculjo\\naryt.exe"	naryt.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1868 set thread context of 1220	1868	aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf.exe	49

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1868	aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe
1124	naryt.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1124	naryt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1124	1868	aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf.exe	28
PID 1868 wrote to memory of 1124	1868	aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf.exe	28
PID 1868 wrote to memory of 1124	1868	aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf.exe	28
PID 1868 wrote to memory of 1124	1868	aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf.exe	28
PID 1124 wrote to memory of 1184	1124	naryt.exe	29
PID 1124 wrote to memory of 1184	1124	naryt.exe	29
PID 1124 wrote to memory of 1184	1124	naryt.exe	29
PID 1124 wrote to memory of 1184	1124	naryt.exe	29
PID 1124 wrote to memory of 1060	1124	naryt.exe	31
PID 1124 wrote to memory of 1060	1124	naryt.exe	31
PID 1124 wrote to memory of 1060	1124	naryt.exe	31
PID 1124 wrote to memory of 1060	1124	naryt.exe	31
PID 1124 wrote to memory of 1428	1124	naryt.exe	37
PID 1124 wrote to memory of 1428	1124	naryt.exe	37
PID 1124 wrote to memory of 1428	1124	naryt.exe	37
PID 1124 wrote to memory of 1428	1124	naryt.exe	37
PID 1124 wrote to memory of 592	1124	naryt.exe	36
PID 1124 wrote to memory of 592	1124	naryt.exe	36
PID 1124 wrote to memory of 592	1124	naryt.exe	36
PID 1124 wrote to memory of 592	1124	naryt.exe	36
PID 1124 wrote to memory of 1792	1124	naryt.exe	34
PID 1124 wrote to memory of 1792	1124	naryt.exe	34
PID 1124 wrote to memory of 1792	1124	naryt.exe	34
PID 1124 wrote to memory of 1792	1124	naryt.exe	34
PID 1124 wrote to memory of 736	1124	naryt.exe	38
PID 1124 wrote to memory of 736	1124	naryt.exe	38
PID 1124 wrote to memory of 736	1124	naryt.exe	38
PID 1124 wrote to memory of 736	1124	naryt.exe	38
PID 1124 wrote to memory of 1588	1124	naryt.exe	39
PID 1124 wrote to memory of 1588	1124	naryt.exe	39
PID 1124 wrote to memory of 1588	1124	naryt.exe	39
PID 1124 wrote to memory of 1588	1124	naryt.exe	39
PID 1124 wrote to memory of 1980	1124	naryt.exe	48
PID 1124 wrote to memory of 1980	1124	naryt.exe	48
PID 1124 wrote to memory of 1980	1124	naryt.exe	48
PID 1124 wrote to memory of 1980	1124	naryt.exe	48
PID 1124 wrote to memory of 1464	1124	naryt.exe	47
PID 1124 wrote to memory of 1464	1124	naryt.exe	47
PID 1124 wrote to memory of 1464	1124	naryt.exe	47
PID 1124 wrote to memory of 1464	1124	naryt.exe	47
PID 1124 wrote to memory of 1552	1124	naryt.exe	42
PID 1124 wrote to memory of 1552	1124	naryt.exe	42
PID 1124 wrote to memory of 1552	1124	naryt.exe	42
PID 1124 wrote to memory of 1552	1124	naryt.exe	42
PID 1124 wrote to memory of 1132	1124	naryt.exe	12
PID 1124 wrote to memory of 1132	1124	naryt.exe	12
PID 1124 wrote to memory of 1132	1124	naryt.exe	12
PID 1124 wrote to memory of 1132	1124	naryt.exe	12
PID 1124 wrote to memory of 1132	1124	naryt.exe	12
PID 1124 wrote to memory of 1228	1124	naryt.exe	11
PID 1124 wrote to memory of 1228	1124	naryt.exe	11
PID 1124 wrote to memory of 1228	1124	naryt.exe	11
PID 1124 wrote to memory of 1228	1124	naryt.exe	11
PID 1124 wrote to memory of 1228	1124	naryt.exe	11
PID 1124 wrote to memory of 1296	1124	naryt.exe	10
PID 1124 wrote to memory of 1296	1124	naryt.exe	10
PID 1124 wrote to memory of 1296	1124	naryt.exe	10
PID 1124 wrote to memory of 1296	1124	naryt.exe	10
PID 1124 wrote to memory of 1296	1124	naryt.exe	10
PID 1124 wrote to memory of 1868	1124	naryt.exe	5
PID 1124 wrote to memory of 1868	1124	naryt.exe	5
PID 1124 wrote to memory of 1868	1124	naryt.exe	5
PID 1124 wrote to memory of 1868	1124	naryt.exe	5
PID 1124 wrote to memory of 1868	1124	naryt.exe	5

C:\Users\Admin\AppData\Local\Temp\aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf.exe
"C:\Users\Admin\AppData\Local\Temp\aea9bfeb25e07b462f619700e263cc7dbc3d79a17435f6cee374348186264faf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Local\Temp\Eculjo\naryt.exe
  "C:\Users\Admin\AppData\Local\Temp\Eculjo\naryt.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1184
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1060
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1792
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:592
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1428
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:736
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1588
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1552
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1464
- - C:\Windows\system32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WHN15EF.bat"
  2⤵
  - Deletes itself
  PID:1220

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1296

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1228

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1132

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1671767564-23570193518289312174428380281334697371-45457773-1174224144-1820905750"
1⤵
PID:1292

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Eculjo\naryt.exe

Filesize
710KB

MD5
0ccb78783ab4902462534925202dc56c

SHA1
68d43e74b8e656f67de87dd87e49a6373a04cd1b

SHA256
a0bee472826ec3d0afff29a1e5efc02ea1513fab57664a6d24a151416137f7a0

SHA512
09460f1878d4dc9b7ed676dba5af92095e6d1ef2faae6196653f6b141cdb159c27786bdd388088a2467ee9ade8aff67149b679a05c36935de740f89ddc1d9b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Eculjo\naryt.exe

Filesize
710KB

MD5
0ccb78783ab4902462534925202dc56c

SHA1
68d43e74b8e656f67de87dd87e49a6373a04cd1b

SHA256
a0bee472826ec3d0afff29a1e5efc02ea1513fab57664a6d24a151416137f7a0

SHA512
09460f1878d4dc9b7ed676dba5af92095e6d1ef2faae6196653f6b141cdb159c27786bdd388088a2467ee9ade8aff67149b679a05c36935de740f89ddc1d9b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WHN15EF.bat

Filesize
274B

MD5
24d44637ff2a1948c950276aec8531ea

SHA1
ce8e98fec3c9da6f3a52755802ff50ee0b26217a

SHA256
ea4754c5b7454a35b395d007f0a584a411ba2151da4c184a5d6273196762b533

SHA512
1e76feb79f5b65d36f3d5eb43a3f8e3174dd4bb9a9f7698eccc4319e02ee9d5982a462b5823f5946474f26869a04adf2e51fd2c4216020589b3867d337cbbeaa

Download Submit
\Users\Admin\AppData\Local\Temp\Eculjo\naryt.exe

Filesize
710KB

MD5
0ccb78783ab4902462534925202dc56c

SHA1
68d43e74b8e656f67de87dd87e49a6373a04cd1b

SHA256
a0bee472826ec3d0afff29a1e5efc02ea1513fab57664a6d24a151416137f7a0

SHA512
09460f1878d4dc9b7ed676dba5af92095e6d1ef2faae6196653f6b141cdb159c27786bdd388088a2467ee9ade8aff67149b679a05c36935de740f89ddc1d9b3b

Download Submit
memory/1124-65-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1124-63-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1124-61-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1124-67-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/1124-109-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/1124-136-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1132-78-0x0000000001EE0000-0x0000000001F49000-memory.dmp

Filesize
420KB

Download
memory/1132-83-0x0000000001EE0000-0x0000000001F49000-memory.dmp

Filesize
420KB

Download
memory/1132-82-0x0000000001EE0000-0x0000000001F49000-memory.dmp

Filesize
420KB

Download
memory/1132-81-0x0000000001EE0000-0x0000000001F49000-memory.dmp

Filesize
420KB

Download
memory/1132-80-0x0000000001EE0000-0x0000000001F49000-memory.dmp

Filesize
420KB

Download
memory/1220-116-0x0000000000050000-0x00000000000B9000-memory.dmp

Filesize
420KB

Download
memory/1220-129-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1220-135-0x0000000000050000-0x00000000000B9000-memory.dmp

Filesize
420KB

Download
memory/1220-133-0x0000000000050000-0x00000000000B9000-memory.dmp

Filesize
420KB

Download
memory/1220-132-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1220-131-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1220-130-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1220-127-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1220-114-0x0000000000050000-0x00000000000B9000-memory.dmp

Filesize
420KB

Download
memory/1220-115-0x0000000000050000-0x00000000000B9000-memory.dmp

Filesize
420KB

Download
memory/1220-112-0x0000000000050000-0x00000000000B9000-memory.dmp

Filesize
420KB

Download
memory/1220-128-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1220-126-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1228-89-0x0000000001C50000-0x0000000001CB9000-memory.dmp

Filesize
420KB

Download
memory/1228-88-0x0000000001C50000-0x0000000001CB9000-memory.dmp

Filesize
420KB

Download
memory/1228-87-0x0000000001C50000-0x0000000001CB9000-memory.dmp

Filesize
420KB

Download
memory/1228-86-0x0000000001C50000-0x0000000001CB9000-memory.dmp

Filesize
420KB

Download
memory/1292-124-0x00000000000D0000-0x0000000000139000-memory.dmp

Filesize
420KB

Download
memory/1292-123-0x00000000000D0000-0x0000000000139000-memory.dmp

Filesize
420KB

Download
memory/1292-122-0x00000000000D0000-0x0000000000139000-memory.dmp

Filesize
420KB

Download
memory/1292-121-0x00000000000D0000-0x0000000000139000-memory.dmp

Filesize
420KB

Download
memory/1296-93-0x0000000002650000-0x00000000026B9000-memory.dmp

Filesize
420KB

Download
memory/1296-95-0x0000000002650000-0x00000000026B9000-memory.dmp

Filesize
420KB

Download
memory/1296-92-0x0000000002650000-0x00000000026B9000-memory.dmp

Filesize
420KB

Download
memory/1296-94-0x0000000002650000-0x00000000026B9000-memory.dmp

Filesize
420KB

Download
memory/1868-99-0x00000000020D0000-0x0000000002139000-memory.dmp

Filesize
420KB

Download
memory/1868-104-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1868-118-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1868-100-0x00000000020D0000-0x0000000002139000-memory.dmp

Filesize
420KB

Download
memory/1868-106-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1868-98-0x00000000020D0000-0x0000000002139000-memory.dmp

Filesize
420KB

Download
memory/1868-54-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1868-102-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1868-103-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1868-101-0x00000000020D0000-0x0000000002139000-memory.dmp

Filesize
420KB

Download
memory/1868-66-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1868-57-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1868-108-0x00000000020D0000-0x0000000002139000-memory.dmp

Filesize
420KB

Download
memory/1868-107-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1868-105-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1868-56-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1868-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/2012-137-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download