Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22-02-2023 08:06

General

  • Target

    9d6f720f4d9bd455371b863ce479c490ebb437ff53c1635fe7befd5eff30af10.exe

  • Size

    312KB

  • MD5

    a3b3e417dc721aaa4fdcaa8f65eef81a

  • SHA1

    21ea098b035b5fd93037054f59ee506aa66d030c

  • SHA256

    9d6f720f4d9bd455371b863ce479c490ebb437ff53c1635fe7befd5eff30af10

  • SHA512

    10b658b0b440c01bf0d1fe49c5092b82a59ba8c4ebd214b4c7b3fae8f3d8c4d67598154bf53e13fbf80174bf7411b4f12e044832967c528c5f917efe5b6f2585

  • SSDEEP

    6144:E4PWLN3m+XeeqeO0UQeQ8KbLVHqAQg5jIQshEPn:6aeqeO0UQB8KFHqAYhEPn

Malware Config

Signatures

  • Detects PseudoManuscrypt payload 28 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • PseudoManuscrypt

    PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 22 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:896
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1224
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1248
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1824
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1416
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2260
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k WspService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      PID:4460
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2460
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2392
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2272
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1092
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:348
  • C:\Users\Admin\AppData\Local\Temp\9d6f720f4d9bd455371b863ce479c490ebb437ff53c1635fe7befd5eff30af10.exe
    "C:\Users\Admin\AppData\Local\Temp\9d6f720f4d9bd455371b863ce479c490ebb437ff53c1635fe7befd5eff30af10.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Users\Admin\AppData\Local\Temp\9d6f720f4d9bd455371b863ce479c490ebb437ff53c1635fe7befd5eff30af10.exe
      "C:\Users\Admin\AppData\Local\Temp\9d6f720f4d9bd455371b863ce479c490ebb437ff53c1635fe7befd5eff30af10.exe" -h
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:3188
  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4964

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\db.dat

    Filesize

    557KB

    MD5

    1bd81dc243577b6a0c7f93f6bd9ae40b

    SHA1

    9d4e908b53e52c5216ea7746d2e1b33abea9bc1c

    SHA256

    3b667512e2dc899bc4e0d92628a981b4487b9423c6ae3804893a30c67a2de21c

    SHA512

    e7e647733b88c78b8bb6c1951780b2627e2b0b66dc2b29d257f2925d837936bd12eaa56b43c7d59ec663e81fa31ec50f4767de8ab1441c645c0890aec79a8d10

  • C:\Users\Admin\AppData\Local\Temp\db.dll

    Filesize

    52KB

    MD5

    1b20e998d058e813dfc515867d31124f

    SHA1

    c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

    SHA256

    24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

    SHA512

    79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

  • \Users\Admin\AppData\Local\Temp\db.dll

    Filesize

    52KB

    MD5

    1b20e998d058e813dfc515867d31124f

    SHA1

    c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

    SHA256

    24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

    SHA512

    79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

  • memory/348-134-0x000001CF6B050000-0x000001CF6B0C2000-memory.dmp

    Filesize

    456KB

  • memory/348-146-0x000001CF6B050000-0x000001CF6B0C2000-memory.dmp

    Filesize

    456KB

  • memory/896-180-0x00000215795C0000-0x0000021579632000-memory.dmp

    Filesize

    456KB

  • memory/896-169-0x00000215795C0000-0x0000021579632000-memory.dmp

    Filesize

    456KB

  • memory/1092-163-0x000001FEE1E70000-0x000001FEE1EE2000-memory.dmp

    Filesize

    456KB

  • memory/1092-178-0x000001FEE1E70000-0x000001FEE1EE2000-memory.dmp

    Filesize

    456KB

  • memory/1224-199-0x000002107BBD0000-0x000002107BC42000-memory.dmp

    Filesize

    456KB

  • memory/1224-220-0x000002107BBD0000-0x000002107BC42000-memory.dmp

    Filesize

    456KB

  • memory/1248-192-0x000001A564EA0000-0x000001A564F12000-memory.dmp

    Filesize

    456KB

  • memory/1248-219-0x000001A564EA0000-0x000001A564F12000-memory.dmp

    Filesize

    456KB

  • memory/1416-217-0x000001664B870000-0x000001664B8E2000-memory.dmp

    Filesize

    456KB

  • memory/1416-176-0x000001664B870000-0x000001664B8E2000-memory.dmp

    Filesize

    456KB

  • memory/1824-186-0x000001FA41B40000-0x000001FA41BB2000-memory.dmp

    Filesize

    456KB

  • memory/1824-218-0x000001FA41B40000-0x000001FA41BB2000-memory.dmp

    Filesize

    456KB

  • memory/2260-175-0x000002895BB40000-0x000002895BBB2000-memory.dmp

    Filesize

    456KB

  • memory/2260-149-0x000002895BB40000-0x000002895BBB2000-memory.dmp

    Filesize

    456KB

  • memory/2272-177-0x000001BCA0480000-0x000001BCA04F2000-memory.dmp

    Filesize

    456KB

  • memory/2272-156-0x000001BCA0480000-0x000001BCA04F2000-memory.dmp

    Filesize

    456KB

  • memory/2392-222-0x0000028BB3930000-0x0000028BB39A2000-memory.dmp

    Filesize

    456KB

  • memory/2392-206-0x0000028BB3930000-0x0000028BB39A2000-memory.dmp

    Filesize

    456KB

  • memory/2460-223-0x0000027942110000-0x0000027942182000-memory.dmp

    Filesize

    456KB

  • memory/2460-213-0x0000027942110000-0x0000027942182000-memory.dmp

    Filesize

    456KB

  • memory/2712-128-0x000001F073250000-0x000001F07329D000-memory.dmp

    Filesize

    308KB

  • memory/2712-142-0x000001F073A70000-0x000001F073AE2000-memory.dmp

    Filesize

    456KB

  • memory/2712-123-0x000001F073250000-0x000001F07329D000-memory.dmp

    Filesize

    308KB

  • memory/2712-126-0x000001F073A70000-0x000001F073AE2000-memory.dmp

    Filesize

    456KB

  • memory/4460-228-0x0000022AB3170000-0x0000022AB31E2000-memory.dmp

    Filesize

    456KB

  • memory/4460-135-0x0000022AB3170000-0x0000022AB31E2000-memory.dmp

    Filesize

    456KB

  • memory/4460-144-0x0000022AB3170000-0x0000022AB31E2000-memory.dmp

    Filesize

    456KB

  • memory/4460-148-0x0000022AB3170000-0x0000022AB31E2000-memory.dmp

    Filesize

    456KB

  • memory/4460-239-0x0000022AB2FC0000-0x0000022AB2FDB000-memory.dmp

    Filesize

    108KB

  • memory/4460-240-0x0000022AB5500000-0x0000022AB560A000-memory.dmp

    Filesize

    1.0MB

  • memory/4460-241-0x0000022AB2FE0000-0x0000022AB3000000-memory.dmp

    Filesize

    128KB

  • memory/4460-242-0x0000022AB4990000-0x0000022AB49AB000-memory.dmp

    Filesize

    108KB

  • memory/4460-263-0x0000022AB5500000-0x0000022AB560A000-memory.dmp

    Filesize

    1.0MB

  • memory/4964-216-0x0000000004F20000-0x0000000004F7E000-memory.dmp

    Filesize

    376KB

  • memory/4964-138-0x0000000004DE0000-0x0000000004EEE000-memory.dmp

    Filesize

    1.1MB

  • memory/4964-140-0x0000000004F20000-0x0000000004F7E000-memory.dmp

    Filesize

    376KB