Analysis
- max time kernel
185s - max time network
205s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
19/02/2022, 17:31
Static task
static1
Behavioral task
behavioral1
Sample
758b3c4beb8a0a8ed26830b0e79fc7da20de1c4943c3314c966d3227ed829974.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
758b3c4beb8a0a8ed26830b0e79fc7da20de1c4943c3314c966d3227ed829974.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target 758b3c4beb8a0a8ed26830b0e79fc7da20de1c4943c3314c966d3227ed829974.exe
- Size 388KB
- Sample220219-v3yhssbcf2
- SHA256 758b3c4beb8a0a8ed26830b0e79fc7da20de1c4943c3314c966d3227ed829974
- MD5 32a56ca79f17fea432250ee704432dfc
- SHA1 0ba7bc223f8cc1f8f0ac2f1a4bf0e0798f9a3b0c
- SHA512 3a6c27d0fae1d2556de95c1a4da88e51f6be0fc9308741f0221e1cc7161e4a873ae94b28123221ddff51b64170fdb72391a765cab3578bcf21063e3807a3bbcc
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3692 conlhost.exe - Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ExitDisconnect.tiff conlhost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe" REG.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "6.817700" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.013207" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899422144346664" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4080" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4296" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.113597" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3968" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "16.685069" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4300" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe Token: SeRestorePrivilege 3236 TiWorker.exe Token: SeSecurityPrivilege 3236 TiWorker.exe Token: SeBackupPrivilege 3236 TiWorker.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2564 wrote to memory of 3692 2564 758b3c4beb8a0a8ed26830b0e79fc7da20de1c4943c3314c966d3227ed829974.exe 68 PID 2564 wrote to memory of 3692 2564 758b3c4beb8a0a8ed26830b0e79fc7da20de1c4943c3314c966d3227ed829974.exe 68 PID 2564 wrote to memory of 3692 2564 758b3c4beb8a0a8ed26830b0e79fc7da20de1c4943c3314c966d3227ed829974.exe 68 PID 3692 wrote to memory of 1120 3692 conlhost.exe 69 PID 3692 wrote to memory of 1120 3692 conlhost.exe 69 PID 3692 wrote to memory of 1120 3692 conlhost.exe 69 PID 3692 wrote to memory of 1212 3692 conlhost.exe 74 PID 3692 wrote to memory of 1212 3692 conlhost.exe 74 PID 3692 wrote to memory of 1212 3692 conlhost.exe 74 PID 3692 wrote to memory of 988 3692 conlhost.exe 84 PID 3692 wrote to memory of 988 3692 conlhost.exe 84 PID 3692 wrote to memory of 988 3692 conlhost.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\758b3c4beb8a0a8ed26830b0e79fc7da20de1c4943c3314c966d3227ed829974.exe"C:\Users\Admin\AppData\Local\Temp\758b3c4beb8a0a8ed26830b0e79fc7da20de1c4943c3314c966d3227ed829974.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\users\Public\conlhost.exe"C:\users\Public\conlhost.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\users\Public\del.bat3⤵PID:1120
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:643⤵
- Adds Run key to start application
PID:1212
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:643⤵PID:988
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3728
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3916
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3236