Analysis

  • max time kernel
    145s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7v200410
  • submitted
    27-04-2020 03:04

General

  • Target

    F820.tmp.exe

  • Size

    813KB

  • MD5

    42e683f3f24484bd47f079b114002571

  • SHA1

    4a7840d449e1454561a34c49f7d91224ef892e2c

  • SHA256

    ce90d07b63358dc14f246849d5a04b41692c849cdd2de04c2dc8b0e161a45b3e

  • SHA512

    fff26cf5458487b88872f5150cf3ee10a2d6b6a94a16e05daf672fb7407c0e417d8477b0d8a5ab96f417669c16149bea98a8075ab7609379cce7006a5be69c8f

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 77 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Drops file in Drivers directory 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Makes http(s) request 19 IoCs

    Contacts server via http/https, possibly for C2 communication.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Loads dropped DLL 16 IoCs
  • Executes dropped EXE 5 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Adds Run entry to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Checks for installed software on the system 1 TTPs 28 IoCs
  • Disables Task Manager via registry modification

Processes

  • C:\Users\Admin\AppData\Local\Temp\F820.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\F820.tmp.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Adds Run entry to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:2024
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\5def4699-2071-43af-b361-72c272756e78" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:1640
    • C:\Users\Admin\AppData\Local\Temp\F820.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\F820.tmp.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Suspicious use of WriteProcessMemory
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:996
      • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
        "C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        • Loads dropped DLL
        • Executes dropped EXE
        PID:1748
        • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
          "C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe" --Admin
          4⤵
          • Suspicious use of WriteProcessMemory
          • Loads dropped DLL
          • Executes dropped EXE
          PID:1780
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: EnumeratesProcesses
            PID:1840
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\script.ps1""' -Verb RunAs}"
            5⤵
            • Suspicious use of WriteProcessMemory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: EnumeratesProcesses
            PID:1584
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\script.ps1
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious behavior: EnumeratesProcesses
              PID:1164
          • C:\Program Files\Windows Defender\mpcmdrun.exe
            "C:\Program Files\Windows Defender\mpcmdrun.exe" -removedefinitions -all
            5⤵
              PID:1696
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat""
              5⤵
                PID:1724
          • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin2.exe
            "C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin2.exe"
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            PID:1820
          • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\5.exe
            "C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\5.exe"
            3⤵
            • Loads dropped DLL
            • Executes dropped EXE
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Checks for installed software on the system
            PID:1568
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /im 5.exe /f & erase C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\5.exe & exit
              4⤵
                PID:1580
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /im 5.exe /f
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Kills process with taskkill
                  PID:1460
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          1⤵
            PID:1388
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {969DBEDC-FA5C-43ED-ADFC-B54FB9707DB8} S-1-5-21-3765897441-2376744223-3151462503-1000:BKIWADLA\Admin:Interactive:[1]
            1⤵
              PID:520
              • C:\Users\Admin\AppData\Local\5def4699-2071-43af-b361-72c272756e78\F820.tmp.exe
                C:\Users\Admin\AppData\Local\5def4699-2071-43af-b361-72c272756e78\F820.tmp.exe --Task
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:700
            • C:\Windows\explorer.exe
              "C:\Windows\explorer.exe"
              1⤵
                PID:1772
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\_readme.txt
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:1656

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              Registry Run Keys / Startup Folder

              1
              T1060

              Defense Evasion

              Modify Registry

              1
              T1112

              File Permissions Modification

              1
              T1222

              Credential Access

              Credentials in Files

              2
              T1081

              Discovery

              Query Registry

              2
              T1012

              System Information Discovery

              1
              T1082

              Collection

              Data from Local System

              2
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\5.exe
              • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\5.exe
              • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin2.exe
              • C:\Users\Admin\AppData\Local\5def4699-2071-43af-b361-72c272756e78\F820.tmp.exe
              • C:\Users\Admin\AppData\Local\5def4699-2071-43af-b361-72c272756e78\F820.tmp.exe
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_05471756-4b9c-45e9-8ddd-05fab605d637
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1d59a429-221c-4f91-aca4-cb149fe0cdc3
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_20b90e15-f237-499e-a823-6772568bf000
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_37386d62-281a-4a91-a575-6755e45f3238
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5028523d-10aa-4674-b3d1-9db9e7b9fbf6
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a24b3c29-8785-47a4-90c7-9951cb5bf055
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b3feaac6-0199-4ad4-87ff-a4b7cbd02223
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
              • C:\Users\Admin\AppData\Local\Temp\delself.bat
              • C:\Users\Admin\AppData\Local\script.ps1
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
              • C:\_readme.txt
              • \ProgramData\mozglue.dll
              • \ProgramData\msvcp140.dll
              • \ProgramData\nss3.dll
              • \ProgramData\vcruntime140.dll
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\5.exe
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\5.exe
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
              • \Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin2.exe
              • memory/700-928-0x00000000045B0000-0x00000000045C1000-memory.dmp
                Filesize

                68KB

              • memory/700-927-0x0000000002D30000-0x0000000002DC1000-memory.dmp
                Filesize

                580KB

              • memory/996-3-0x0000000000320000-0x00000000003B1000-memory.dmp
                Filesize

                580KB

              • memory/996-59-0x0000000005DB0000-0x0000000005DC1000-memory.dmp
                Filesize

                68KB

              • memory/996-57-0x00000000061C0000-0x00000000061D1000-memory.dmp
                Filesize

                68KB

              • memory/996-56-0x0000000005DB0000-0x0000000005DC1000-memory.dmp
                Filesize

                68KB

              • memory/996-4-0x0000000004770000-0x0000000004781000-memory.dmp
                Filesize

                68KB

              • memory/1568-32-0x0000000000B70000-0x0000000000B81000-memory.dmp
                Filesize

                68KB

              • memory/1568-31-0x000000000030A000-0x000000000030B000-memory.dmp
                Filesize

                4KB

              • memory/1748-12-0x0000000002000000-0x0000000002011000-memory.dmp
                Filesize

                68KB

              • memory/1748-13-0x00000000005D0000-0x00000000005D1000-memory.dmp
                Filesize

                4KB

              • memory/1780-20-0x0000000001FB0000-0x0000000001FC1000-memory.dmp
                Filesize

                68KB

              • memory/1780-23-0x0000000000512000-0x0000000000513000-memory.dmp
                Filesize

                4KB

              • memory/1820-25-0x000000000059F000-0x00000000005A0000-memory.dmp
                Filesize

                4KB

              • memory/1820-24-0x0000000001F30000-0x0000000001F41000-memory.dmp
                Filesize

                68KB

              • memory/2024-0-0x0000000000300000-0x0000000000391000-memory.dmp
                Filesize

                580KB

              • memory/2024-1-0x00000000045B0000-0x00000000045C1000-memory.dmp
                Filesize

                68KB