23e1b2051d263e36627e488507b118c1c1db489ce9622c592201faeaf6182d5f

General

Target

Confirm_Cheque.exe
Size

376KB
MD5

6acbe94f31ef95152e956a0b6e81c6b7
SHA1

17f42b347f265d8bc8047df7ae4140e9c28792e0
SHA256

b9a493df37ecf4be7f92c1da6d1422ffa38490b5fe336424f30bf095c4073d51
SHA512

3ca582c20bdba7eb455be07257650840d13ec9fd06f80c35f8982b09a04fd184b84ff9b9cc60f8d04f921bc944e5c90f3dc541e61d87805cb0e6b08e5fa3b2cc

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2104	svchost.exe
Token: SeCreatePagefilePrivilege	2104	svchost.exe
Token: SeShutdownPrivilege	2104	svchost.exe
Token: SeCreatePagefilePrivilege	2104	svchost.exe
Token: SeShutdownPrivilege	2104	svchost.exe
Token: SeCreatePagefilePrivilege	2104	svchost.exe
Token: SeSecurityPrivilege	2700	TiWorker.exe
Token: SeRestorePrivilege	2700	TiWorker.exe
Token: SeBackupPrivilege	2700	TiWorker.exe
Token: SeBackupPrivilege	2700	TiWorker.exe
Token: SeRestorePrivilege	2700	TiWorker.exe
Token: SeSecurityPrivilege	2700	TiWorker.exe
Token: SeBackupPrivilege	2700	TiWorker.exe
Token: SeRestorePrivilege	2700	TiWorker.exe
Token: SeSecurityPrivilege	2700	TiWorker.exe
Token: SeBackupPrivilege	2700	TiWorker.exe
Token: SeRestorePrivilege	2700	TiWorker.exe
Token: SeSecurityPrivilege	2700	TiWorker.exe
Token: SeBackupPrivilege	2700	TiWorker.exe
Token: SeRestorePrivilege	2700	TiWorker.exe
Token: SeSecurityPrivilege	2700	TiWorker.exe
Token: SeBackupPrivilege	2700	TiWorker.exe
Token: SeRestorePrivilege	2700	TiWorker.exe
Token: SeSecurityPrivilege	2700	TiWorker.exe
Token: SeBackupPrivilege	2700	TiWorker.exe
Token: SeRestorePrivilege	2700	TiWorker.exe
Token: SeSecurityPrivilege	2700	TiWorker.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4700	Confirm_Cheque.exe
4700	Confirm_Cheque.exe
4700	Confirm_Cheque.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2032	4700	Confirm_Cheque.exe	82
PID 4700 wrote to memory of 2032	4700	Confirm_Cheque.exe	82
PID 4700 wrote to memory of 2032	4700	Confirm_Cheque.exe	82

C:\Users\Admin\AppData\Local\Temp\Confirm_Cheque.exe
"C:\Users\Admin\AppData\Local\Temp\Confirm_Cheque.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-138-0x00000211C6180000-0x00000211C6190000-memory.dmp

Filesize
64KB

Download
memory/1912-139-0x00000211C8550000-0x00000211C8554000-memory.dmp

Filesize
16KB

Download
memory/2104-152-0x00000228629A0000-0x00000228629A4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing