Overview
overview
10Static
static
3000.exe
windows7-x64
000.exe
windows10-2004-x64
Ana.exe
windows7-x64
8Ana.exe
windows10-2004-x64
Bad Rabit.exe
windows7-x64
10Bad Rabit.exe
windows10-2004-x64
10D34TH 2.0 .bat
windows7-x64
8D34TH 2.0 .bat
windows10-2004-x64
8DDOS.bat
windows7-x64
3DDOS.bat
windows10-2004-x64
7Desktop Puzzle.exe
windows7-x64
1Desktop Puzzle.exe
windows10-2004-x64
1Memz.exe
windows7-x64
6Memz.exe
windows10-2004-x64
7NoEscape.exe
windows7-x64
1NoEscape.exe
windows10-2004-x64
Phantom Crypter.bat
windows7-x64
8Phantom Crypter.bat
windows10-2004-x64
8WannaCrypt0r.exe
windows7-x64
10WannaCrypt0r.exe
windows10-2004-x64
10infinite locker.bat
windows7-x64
7infinite locker.bat
windows10-2004-x64
7Resubmissions
19-04-2024 11:45
240419-nw88dsag38 1019-04-2024 11:43
240419-nv23pabf2x 319-04-2024 10:25
240419-mf6a5agh7t 10Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 10:25
Static task
static1
Behavioral task
behavioral1
Sample
000.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
000.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Ana.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral4
Sample
Ana.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Bad Rabit.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
Bad Rabit.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
D34TH 2.0 .bat
Resource
win7-20240319-en
windows7-x64
Behavioral task
behavioral8
Sample
D34TH 2.0 .bat
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
DDOS.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
DDOS.bat
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Desktop Puzzle.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
Desktop Puzzle.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Memz.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
Memz.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
NoEscape.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral16
Sample
NoEscape.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Phantom Crypter.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
Phantom Crypter.bat
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
WannaCrypt0r.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
WannaCrypt0r.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
infinite locker.bat
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
infinite locker.bat
Resource
win10v2004-20240412-en
windows10-2004-x64
General
-
Target
Phantom Crypter.bat
-
Size
5KB
-
MD5
86048f27a743bfd1c7e50fc611e50047
-
SHA1
3ff7974076f5b600fd7bddf0b0b1cf98247d46c3
-
SHA256
2d07538b05f785bec00733dd27374d46411042344c08a847f9f0ce297479cb6e
-
SHA512
84e5b6ce2ecb65fc4f294f1a940ce76ab8f929e619ff5659040a082a4d55bf0be047884c8111d4aa0482131919611590e4c9ab4aa2e88ccb6ffe508a85f48bfe
-
SSDEEP
96:1E2FFXpOnWvbClLy2Ju7y5KQZ2Ju7y5KJ:1E2VbClLyX7ycCX7ycJ
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 7 IoCs
pid Process 2544 netsh.exe 2736 netsh.exe 2572 netsh.exe 2564 netsh.exe 2744 netsh.exe 896 netsh.exe 2040 netsh.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSysBotBoot.bat cmd.exe -
Modifies file permissions 1 TTPs 5 IoCs
pid Process 2208 takeown.exe 300 takeown.exe 2200 takeown.exe 3056 takeown.exe 280 takeown.exe -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\System32\WinBot64\WinBot64.bat cmd.exe File created C:\Windows\System32\WinBot64.bat cmd.exe File created C:\Windows\SysWOW64\WinBot32\WinBotLogInfo.txt cmd.exe File created C:\Windows\SysWOW64\WinBot32.bat cmd.exe File created C:\Windows\System32\F.log cmd.exe File created C:\Windows\SysWOW64\WinBot32\WinBot32.bat cmd.exe File created C:\Windows\SysWOW64\WinBotLogInfo.txt cmd.exe File created C:\Windows\System32\Autostart.bat cmd.exe File opened for modification C:\Windows\System32\F.log cmd.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\System\WinSysBot\WinSysBot.bat cmd.exe File created C:\Windows\System\WinSysBot.bat cmd.exe File created C:\Windows\WinSxS\WinSyS\OsHelpBot.vbs cmd.exe File created C:\Windows\WinSxS\WinSyS\OsBrowserUpd.vbs cmd.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1432 ipconfig.exe 2968 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1872 systeminfo.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2200 takeown.exe Token: SeTakeOwnershipPrivilege 3056 takeown.exe Token: SeTakeOwnershipPrivilege 280 takeown.exe Token: SeTakeOwnershipPrivilege 2208 takeown.exe Token: SeTakeOwnershipPrivilege 300 takeown.exe Token: SeIncreaseQuotaPrivilege 3024 WMIC.exe Token: SeSecurityPrivilege 3024 WMIC.exe Token: SeTakeOwnershipPrivilege 3024 WMIC.exe Token: SeLoadDriverPrivilege 3024 WMIC.exe Token: SeSystemProfilePrivilege 3024 WMIC.exe Token: SeSystemtimePrivilege 3024 WMIC.exe Token: SeProfSingleProcessPrivilege 3024 WMIC.exe Token: SeIncBasePriorityPrivilege 3024 WMIC.exe Token: SeCreatePagefilePrivilege 3024 WMIC.exe Token: SeBackupPrivilege 3024 WMIC.exe Token: SeRestorePrivilege 3024 WMIC.exe Token: SeShutdownPrivilege 3024 WMIC.exe Token: SeDebugPrivilege 3024 WMIC.exe Token: SeSystemEnvironmentPrivilege 3024 WMIC.exe Token: SeRemoteShutdownPrivilege 3024 WMIC.exe Token: SeUndockPrivilege 3024 WMIC.exe Token: SeManageVolumePrivilege 3024 WMIC.exe Token: 33 3024 WMIC.exe Token: 34 3024 WMIC.exe Token: 35 3024 WMIC.exe Token: SeIncreaseQuotaPrivilege 3024 WMIC.exe Token: SeSecurityPrivilege 3024 WMIC.exe Token: SeTakeOwnershipPrivilege 3024 WMIC.exe Token: SeLoadDriverPrivilege 3024 WMIC.exe Token: SeSystemProfilePrivilege 3024 WMIC.exe Token: SeSystemtimePrivilege 3024 WMIC.exe Token: SeProfSingleProcessPrivilege 3024 WMIC.exe Token: SeIncBasePriorityPrivilege 3024 WMIC.exe Token: SeCreatePagefilePrivilege 3024 WMIC.exe Token: SeBackupPrivilege 3024 WMIC.exe Token: SeRestorePrivilege 3024 WMIC.exe Token: SeShutdownPrivilege 3024 WMIC.exe Token: SeDebugPrivilege 3024 WMIC.exe Token: SeSystemEnvironmentPrivilege 3024 WMIC.exe Token: SeRemoteShutdownPrivilege 3024 WMIC.exe Token: SeUndockPrivilege 3024 WMIC.exe Token: SeManageVolumePrivilege 3024 WMIC.exe Token: 33 3024 WMIC.exe Token: 34 3024 WMIC.exe Token: 35 3024 WMIC.exe Token: SeIncreaseQuotaPrivilege 1640 WMIC.exe Token: SeSecurityPrivilege 1640 WMIC.exe Token: SeTakeOwnershipPrivilege 1640 WMIC.exe Token: SeLoadDriverPrivilege 1640 WMIC.exe Token: SeSystemProfilePrivilege 1640 WMIC.exe Token: SeSystemtimePrivilege 1640 WMIC.exe Token: SeProfSingleProcessPrivilege 1640 WMIC.exe Token: SeIncBasePriorityPrivilege 1640 WMIC.exe Token: SeCreatePagefilePrivilege 1640 WMIC.exe Token: SeBackupPrivilege 1640 WMIC.exe Token: SeRestorePrivilege 1640 WMIC.exe Token: SeShutdownPrivilege 1640 WMIC.exe Token: SeDebugPrivilege 1640 WMIC.exe Token: SeSystemEnvironmentPrivilege 1640 WMIC.exe Token: SeRemoteShutdownPrivilege 1640 WMIC.exe Token: SeUndockPrivilege 1640 WMIC.exe Token: SeManageVolumePrivilege 1640 WMIC.exe Token: 33 1640 WMIC.exe Token: 34 1640 WMIC.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2200 2940 cmd.exe 29 PID 2940 wrote to memory of 2200 2940 cmd.exe 29 PID 2940 wrote to memory of 2200 2940 cmd.exe 29 PID 2940 wrote to memory of 3056 2940 cmd.exe 30 PID 2940 wrote to memory of 3056 2940 cmd.exe 30 PID 2940 wrote to memory of 3056 2940 cmd.exe 30 PID 2940 wrote to memory of 280 2940 cmd.exe 31 PID 2940 wrote to memory of 280 2940 cmd.exe 31 PID 2940 wrote to memory of 280 2940 cmd.exe 31 PID 2940 wrote to memory of 2208 2940 cmd.exe 32 PID 2940 wrote to memory of 2208 2940 cmd.exe 32 PID 2940 wrote to memory of 2208 2940 cmd.exe 32 PID 2940 wrote to memory of 300 2940 cmd.exe 33 PID 2940 wrote to memory of 300 2940 cmd.exe 33 PID 2940 wrote to memory of 300 2940 cmd.exe 33 PID 2940 wrote to memory of 2040 2940 cmd.exe 34 PID 2940 wrote to memory of 2040 2940 cmd.exe 34 PID 2940 wrote to memory of 2040 2940 cmd.exe 34 PID 2940 wrote to memory of 2544 2940 cmd.exe 35 PID 2940 wrote to memory of 2544 2940 cmd.exe 35 PID 2940 wrote to memory of 2544 2940 cmd.exe 35 PID 2940 wrote to memory of 2736 2940 cmd.exe 36 PID 2940 wrote to memory of 2736 2940 cmd.exe 36 PID 2940 wrote to memory of 2736 2940 cmd.exe 36 PID 2940 wrote to memory of 2572 2940 cmd.exe 37 PID 2940 wrote to memory of 2572 2940 cmd.exe 37 PID 2940 wrote to memory of 2572 2940 cmd.exe 37 PID 2940 wrote to memory of 2564 2940 cmd.exe 38 PID 2940 wrote to memory of 2564 2940 cmd.exe 38 PID 2940 wrote to memory of 2564 2940 cmd.exe 38 PID 2940 wrote to memory of 2744 2940 cmd.exe 39 PID 2940 wrote to memory of 2744 2940 cmd.exe 39 PID 2940 wrote to memory of 2744 2940 cmd.exe 39 PID 2940 wrote to memory of 896 2940 cmd.exe 40 PID 2940 wrote to memory of 896 2940 cmd.exe 40 PID 2940 wrote to memory of 896 2940 cmd.exe 40 PID 2940 wrote to memory of 2456 2940 cmd.exe 41 PID 2940 wrote to memory of 2456 2940 cmd.exe 41 PID 2940 wrote to memory of 2456 2940 cmd.exe 41 PID 2940 wrote to memory of 2296 2940 cmd.exe 42 PID 2940 wrote to memory of 2296 2940 cmd.exe 42 PID 2940 wrote to memory of 2296 2940 cmd.exe 42 PID 2940 wrote to memory of 1432 2940 cmd.exe 43 PID 2940 wrote to memory of 1432 2940 cmd.exe 43 PID 2940 wrote to memory of 1432 2940 cmd.exe 43 PID 2940 wrote to memory of 2968 2940 cmd.exe 44 PID 2940 wrote to memory of 2968 2940 cmd.exe 44 PID 2940 wrote to memory of 2968 2940 cmd.exe 44 PID 2940 wrote to memory of 2984 2940 cmd.exe 45 PID 2940 wrote to memory of 2984 2940 cmd.exe 45 PID 2940 wrote to memory of 2984 2940 cmd.exe 45 PID 2940 wrote to memory of 3024 2940 cmd.exe 46 PID 2940 wrote to memory of 3024 2940 cmd.exe 46 PID 2940 wrote to memory of 3024 2940 cmd.exe 46 PID 2940 wrote to memory of 1640 2940 cmd.exe 48 PID 2940 wrote to memory of 1640 2940 cmd.exe 48 PID 2940 wrote to memory of 1640 2940 cmd.exe 48 PID 2940 wrote to memory of 1872 2940 cmd.exe 49 PID 2940 wrote to memory of 1872 2940 cmd.exe 49 PID 2940 wrote to memory of 1872 2940 cmd.exe 49 PID 2940 wrote to memory of 2800 2940 cmd.exe 51 PID 2940 wrote to memory of 2800 2940 cmd.exe 51 PID 2940 wrote to memory of 2800 2940 cmd.exe 51
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Phantom Crypter.bat"1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System322⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System2⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\SysWOW642⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:280
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\WinSxS2⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows2⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:300
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode disable2⤵
- Modifies Windows Firewall
PID:2040
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=DISABLE2⤵
- Modifies Windows Firewall
PID:2544
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off2⤵
- Modifies Windows Firewall
PID:2736
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set domainprofile state off2⤵
- Modifies Windows Firewall
PID:2572
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set privateprofile state off2⤵
- Modifies Windows Firewall
PID:2564
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set publicprofile state off2⤵
- Modifies Windows Firewall
PID:2744
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
PID:896
-
-
C:\Windows\System32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com2⤵PID:2456
-
-
C:\Windows\System32\netsh.exenetsh wlan show profiles2⤵PID:2296
-
-
C:\Windows\System32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:1432
-
-
C:\Windows\System32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:2968
-
-
C:\Windows\System32\find.exefind /i "IPv4"2⤵PID:2984
-
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get size2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\System32\systeminfo.exesysteminfo2⤵
- Gathers system information
PID:1872
-
-
C:\Windows\System32\cmd.execmd.exe2⤵PID:2800
-