Overview
overview
10Static
static
3000.exe
windows10-1703-x64
000.exe
windows10-2004-x64
Ana.exe
windows10-1703-x64
7Ana.exe
windows10-2004-x64
Bad Rabit.exe
windows10-1703-x64
10Bad Rabit.exe
windows10-2004-x64
10D34TH 2.0 .bat
windows10-1703-x64
8D34TH 2.0 .bat
windows10-2004-x64
8DDOS.bat
windows10-1703-x64
3DDOS.bat
windows10-2004-x64
7Desktop Puzzle.exe
windows10-1703-x64
1Desktop Puzzle.exe
windows10-2004-x64
1Memz.exe
windows10-1703-x64
7Memz.exe
windows10-2004-x64
7NoEscape.exe
windows10-1703-x64
NoEscape.exe
windows10-2004-x64
Phantom Crypter.bat
windows10-1703-x64
8Phantom Crypter.bat
windows10-2004-x64
8WannaCrypt0r.exe
windows10-1703-x64
10WannaCrypt0r.exe
windows10-2004-x64
10infinite locker.bat
windows10-1703-x64
7infinite locker.bat
windows10-2004-x64
7Analysis
-
max time kernel
134s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19-04-2024 10:23
Static task
static1
Behavioral task
behavioral1
Sample
000.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
000.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
Ana.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Ana.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
Bad Rabit.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Bad Rabit.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
D34TH 2.0 .bat
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
D34TH 2.0 .bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
DDOS.bat
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
DDOS.bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
Desktop Puzzle.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
Desktop Puzzle.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
Memz.exe
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Memz.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
NoEscape.exe
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
NoEscape.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
Phantom Crypter.bat
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
Phantom Crypter.bat
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
WannaCrypt0r.exe
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
WannaCrypt0r.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
infinite locker.bat
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
infinite locker.bat
Resource
win10v2004-20240412-en
General
-
Target
Phantom Crypter.bat
-
Size
5KB
-
MD5
86048f27a743bfd1c7e50fc611e50047
-
SHA1
3ff7974076f5b600fd7bddf0b0b1cf98247d46c3
-
SHA256
2d07538b05f785bec00733dd27374d46411042344c08a847f9f0ce297479cb6e
-
SHA512
84e5b6ce2ecb65fc4f294f1a940ce76ab8f929e619ff5659040a082a4d55bf0be047884c8111d4aa0482131919611590e4c9ab4aa2e88ccb6ffe508a85f48bfe
-
SSDEEP
96:1E2FFXpOnWvbClLy2Ju7y5KQZ2Ju7y5KJ:1E2VbClLyX7ycCX7ycJ
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 7 IoCs
Processes:
netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exepid process 3344 netsh.exe 1560 netsh.exe 3700 netsh.exe 3624 netsh.exe 2788 netsh.exe 4276 netsh.exe 4936 netsh.exe -
Drops startup file 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSysBotBoot.bat cmd.exe -
Modifies file permissions 1 TTPs 5 IoCs
Processes:
takeown.exetakeown.exetakeown.exetakeown.exetakeown.exepid process 3452 takeown.exe 4856 takeown.exe 3708 takeown.exe 4488 takeown.exe 1520 takeown.exe -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Drops file in System32 directory 9 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\System32\Autostart.bat cmd.exe File created C:\Windows\SysWOW64\WinBotLogInfo.txt cmd.exe File created C:\Windows\System32\F.log cmd.exe File opened for modification C:\Windows\System32\F.log cmd.exe File created C:\Windows\System32\WinBot64\WinBot64.bat cmd.exe File created C:\Windows\System32\WinBot64.bat cmd.exe File created C:\Windows\SysWOW64\WinBot32\WinBot32.bat cmd.exe File created C:\Windows\SysWOW64\WinBot32\WinBotLogInfo.txt cmd.exe File created C:\Windows\SysWOW64\WinBot32.bat cmd.exe -
Drops file in Windows directory 4 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\System\WinSysBot.bat cmd.exe File created C:\Windows\WinSxS\WinSyS\OsHelpBot.vbs cmd.exe File created C:\Windows\WinSxS\WinSyS\OsBrowserUpd.vbs cmd.exe File created C:\Windows\System\WinSysBot\WinSysBot.bat cmd.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 800 ipconfig.exe 4212 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
takeown.exetakeown.exetakeown.exetakeown.exetakeown.exeWMIC.exeWMIC.exedescription pid process Token: SeTakeOwnershipPrivilege 4856 takeown.exe Token: SeTakeOwnershipPrivilege 3708 takeown.exe Token: SeTakeOwnershipPrivilege 4488 takeown.exe Token: SeTakeOwnershipPrivilege 3452 takeown.exe Token: SeTakeOwnershipPrivilege 1520 takeown.exe Token: SeIncreaseQuotaPrivilege 4352 WMIC.exe Token: SeSecurityPrivilege 4352 WMIC.exe Token: SeTakeOwnershipPrivilege 4352 WMIC.exe Token: SeLoadDriverPrivilege 4352 WMIC.exe Token: SeSystemProfilePrivilege 4352 WMIC.exe Token: SeSystemtimePrivilege 4352 WMIC.exe Token: SeProfSingleProcessPrivilege 4352 WMIC.exe Token: SeIncBasePriorityPrivilege 4352 WMIC.exe Token: SeCreatePagefilePrivilege 4352 WMIC.exe Token: SeBackupPrivilege 4352 WMIC.exe Token: SeRestorePrivilege 4352 WMIC.exe Token: SeShutdownPrivilege 4352 WMIC.exe Token: SeDebugPrivilege 4352 WMIC.exe Token: SeSystemEnvironmentPrivilege 4352 WMIC.exe Token: SeRemoteShutdownPrivilege 4352 WMIC.exe Token: SeUndockPrivilege 4352 WMIC.exe Token: SeManageVolumePrivilege 4352 WMIC.exe Token: 33 4352 WMIC.exe Token: 34 4352 WMIC.exe Token: 35 4352 WMIC.exe Token: 36 4352 WMIC.exe Token: SeIncreaseQuotaPrivilege 4352 WMIC.exe Token: SeSecurityPrivilege 4352 WMIC.exe Token: SeTakeOwnershipPrivilege 4352 WMIC.exe Token: SeLoadDriverPrivilege 4352 WMIC.exe Token: SeSystemProfilePrivilege 4352 WMIC.exe Token: SeSystemtimePrivilege 4352 WMIC.exe Token: SeProfSingleProcessPrivilege 4352 WMIC.exe Token: SeIncBasePriorityPrivilege 4352 WMIC.exe Token: SeCreatePagefilePrivilege 4352 WMIC.exe Token: SeBackupPrivilege 4352 WMIC.exe Token: SeRestorePrivilege 4352 WMIC.exe Token: SeShutdownPrivilege 4352 WMIC.exe Token: SeDebugPrivilege 4352 WMIC.exe Token: SeSystemEnvironmentPrivilege 4352 WMIC.exe Token: SeRemoteShutdownPrivilege 4352 WMIC.exe Token: SeUndockPrivilege 4352 WMIC.exe Token: SeManageVolumePrivilege 4352 WMIC.exe Token: 33 4352 WMIC.exe Token: 34 4352 WMIC.exe Token: 35 4352 WMIC.exe Token: 36 4352 WMIC.exe Token: SeIncreaseQuotaPrivilege 2164 WMIC.exe Token: SeSecurityPrivilege 2164 WMIC.exe Token: SeTakeOwnershipPrivilege 2164 WMIC.exe Token: SeLoadDriverPrivilege 2164 WMIC.exe Token: SeSystemProfilePrivilege 2164 WMIC.exe Token: SeSystemtimePrivilege 2164 WMIC.exe Token: SeProfSingleProcessPrivilege 2164 WMIC.exe Token: SeIncBasePriorityPrivilege 2164 WMIC.exe Token: SeCreatePagefilePrivilege 2164 WMIC.exe Token: SeBackupPrivilege 2164 WMIC.exe Token: SeRestorePrivilege 2164 WMIC.exe Token: SeShutdownPrivilege 2164 WMIC.exe Token: SeDebugPrivilege 2164 WMIC.exe Token: SeSystemEnvironmentPrivilege 2164 WMIC.exe Token: SeRemoteShutdownPrivilege 2164 WMIC.exe Token: SeUndockPrivilege 2164 WMIC.exe Token: SeManageVolumePrivilege 2164 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
cmd.exedescription pid process target process PID 168 wrote to memory of 4856 168 cmd.exe takeown.exe PID 168 wrote to memory of 4856 168 cmd.exe takeown.exe PID 168 wrote to memory of 3708 168 cmd.exe takeown.exe PID 168 wrote to memory of 3708 168 cmd.exe takeown.exe PID 168 wrote to memory of 4488 168 cmd.exe takeown.exe PID 168 wrote to memory of 4488 168 cmd.exe takeown.exe PID 168 wrote to memory of 3452 168 cmd.exe takeown.exe PID 168 wrote to memory of 3452 168 cmd.exe takeown.exe PID 168 wrote to memory of 1520 168 cmd.exe takeown.exe PID 168 wrote to memory of 1520 168 cmd.exe takeown.exe PID 168 wrote to memory of 1560 168 cmd.exe netsh.exe PID 168 wrote to memory of 1560 168 cmd.exe netsh.exe PID 168 wrote to memory of 3700 168 cmd.exe netsh.exe PID 168 wrote to memory of 3700 168 cmd.exe netsh.exe PID 168 wrote to memory of 3624 168 cmd.exe netsh.exe PID 168 wrote to memory of 3624 168 cmd.exe netsh.exe PID 168 wrote to memory of 2788 168 cmd.exe netsh.exe PID 168 wrote to memory of 2788 168 cmd.exe netsh.exe PID 168 wrote to memory of 4276 168 cmd.exe netsh.exe PID 168 wrote to memory of 4276 168 cmd.exe netsh.exe PID 168 wrote to memory of 4936 168 cmd.exe netsh.exe PID 168 wrote to memory of 4936 168 cmd.exe netsh.exe PID 168 wrote to memory of 3344 168 cmd.exe netsh.exe PID 168 wrote to memory of 3344 168 cmd.exe netsh.exe PID 168 wrote to memory of 3164 168 cmd.exe nslookup.exe PID 168 wrote to memory of 3164 168 cmd.exe nslookup.exe PID 168 wrote to memory of 1384 168 cmd.exe netsh.exe PID 168 wrote to memory of 1384 168 cmd.exe netsh.exe PID 168 wrote to memory of 800 168 cmd.exe ipconfig.exe PID 168 wrote to memory of 800 168 cmd.exe ipconfig.exe PID 168 wrote to memory of 4212 168 cmd.exe ipconfig.exe PID 168 wrote to memory of 4212 168 cmd.exe ipconfig.exe PID 168 wrote to memory of 3376 168 cmd.exe find.exe PID 168 wrote to memory of 3376 168 cmd.exe find.exe PID 168 wrote to memory of 4352 168 cmd.exe WMIC.exe PID 168 wrote to memory of 4352 168 cmd.exe WMIC.exe PID 168 wrote to memory of 2164 168 cmd.exe WMIC.exe PID 168 wrote to memory of 2164 168 cmd.exe WMIC.exe PID 168 wrote to memory of 4068 168 cmd.exe systeminfo.exe PID 168 wrote to memory of 4068 168 cmd.exe systeminfo.exe PID 168 wrote to memory of 1612 168 cmd.exe cmd.exe PID 168 wrote to memory of 1612 168 cmd.exe cmd.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Phantom Crypter.bat"1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System322⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System2⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\SysWOW642⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\WinSxS2⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows2⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\netsh.exenetsh firewall set opmode disable2⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=DISABLE2⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off2⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh advfirewall set domainprofile state off2⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh advfirewall set privateprofile state off2⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh advfirewall set publicprofile state off2⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
-
C:\Windows\System32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com2⤵
-
C:\Windows\System32\netsh.exenetsh wlan show profiles2⤵
-
C:\Windows\System32\ipconfig.exeipconfig2⤵
- Gathers network information
-
C:\Windows\System32\ipconfig.exeipconfig2⤵
- Gathers network information
-
C:\Windows\System32\find.exefind /i "IPv4"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get size2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\System32\cmd.execmd.exe2⤵