Analysis
-
max time kernel
150s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
15-02-2022 15:02
Static task
static1
Behavioral task
behavioral1
Sample
213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exe
Resource
win7-en-20211208
General
-
Target
213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exe
-
Size
3.4MB
-
MD5
97a1f8d3a08336c5eb1b64ed37bc7427
-
SHA1
ffb3c8454c58f93ce8fa4c8c81202e7f327193f6
-
SHA256
213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013
-
SHA512
84fd0b819c232ed860b209317b379e618bdbefac188f9f68059b7cf51ceac242fee6e08b0d8aaa9209fc5e39953f1161b895eb25660784792826d1e1bde3a564
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
IntelRapid.exepid process 1908 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
IntelRapid.exe213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe -
Drops startup file 1 IoCs
Processes:
213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk 213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exe -
Processes:
resource yara_rule behavioral2/memory/4876-131-0x00007FF7ADEE0000-0x00007FF7AE803000-memory.dmp themida behavioral2/memory/4876-132-0x00007FF7ADEE0000-0x00007FF7AE803000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral2/memory/1908-135-0x00007FF6A1C90000-0x00007FF6A25B3000-memory.dmp themida behavioral2/memory/1908-136-0x00007FF6A1C90000-0x00007FF6A25B3000-memory.dmp themida -
Processes:
213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exeIntelRapid.exepid process 4876 213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exe 1908 IntelRapid.exe -
Drops file in Windows directory 8 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 1908 IntelRapid.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exeTiWorker.exedescription pid process Token: SeShutdownPrivilege 4380 svchost.exe Token: SeCreatePagefilePrivilege 4380 svchost.exe Token: SeShutdownPrivilege 4380 svchost.exe Token: SeCreatePagefilePrivilege 4380 svchost.exe Token: SeShutdownPrivilege 4380 svchost.exe Token: SeCreatePagefilePrivilege 4380 svchost.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe Token: SeRestorePrivilege 2848 TiWorker.exe Token: SeSecurityPrivilege 2848 TiWorker.exe Token: SeBackupPrivilege 2848 TiWorker.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exedescription pid process target process PID 4876 wrote to memory of 1908 4876 213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exe IntelRapid.exe PID 4876 wrote to memory of 1908 4876 213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exe IntelRapid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exe"C:\Users\Admin\AppData\Local\Temp\213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
97a1f8d3a08336c5eb1b64ed37bc7427
SHA1ffb3c8454c58f93ce8fa4c8c81202e7f327193f6
SHA256213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013
SHA51284fd0b819c232ed860b209317b379e618bdbefac188f9f68059b7cf51ceac242fee6e08b0d8aaa9209fc5e39953f1161b895eb25660784792826d1e1bde3a564
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
97a1f8d3a08336c5eb1b64ed37bc7427
SHA1ffb3c8454c58f93ce8fa4c8c81202e7f327193f6
SHA256213c5947e50b9edd68412d2850e08e32bd41c1473cba614f78c396a63be40013
SHA51284fd0b819c232ed860b209317b379e618bdbefac188f9f68059b7cf51ceac242fee6e08b0d8aaa9209fc5e39953f1161b895eb25660784792826d1e1bde3a564
-
memory/1908-135-0x00007FF6A1C90000-0x00007FF6A25B3000-memory.dmpFilesize
9.1MB
-
memory/1908-136-0x00007FF6A1C90000-0x00007FF6A25B3000-memory.dmpFilesize
9.1MB
-
memory/4380-137-0x000001ED22760000-0x000001ED22770000-memory.dmpFilesize
64KB
-
memory/4380-138-0x000001ED22D20000-0x000001ED22D30000-memory.dmpFilesize
64KB
-
memory/4380-139-0x000001ED25390000-0x000001ED25394000-memory.dmpFilesize
16KB
-
memory/4876-130-0x00007FF911FF0000-0x00007FF911FF2000-memory.dmpFilesize
8KB
-
memory/4876-131-0x00007FF7ADEE0000-0x00007FF7AE803000-memory.dmpFilesize
9.1MB
-
memory/4876-132-0x00007FF7ADEE0000-0x00007FF7AE803000-memory.dmpFilesize
9.1MB