Analysis
-
max time kernel
163s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
19-02-2022 21:25
Static task
static1
Behavioral task
behavioral1
Sample
c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353.exe
-
Size
287KB
-
MD5
ef45a5b40438205dc050f4afebc278b5
-
SHA1
6760ea10d2e201b688d841ee11c841653ede94f5
-
SHA256
c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353
-
SHA512
fcceff6a644a09fdae46ffc306743277d6cc078c273b7dd6f85be97592aa23ca4631bf6564dbd130f9aaa38536066af3b61713a07984e9d7e0a9909cd635b021
Malware Config
Extracted
Family
gootkit
Botnet
6546
C2
servicemanager.icu
partnerservice.xyz
Attributes
-
vendor_id
6546
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe -
Modifies data under HKEY_USERS 52 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4136" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899559435690221" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4320" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "8.334258" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.013193" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.125057" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3988" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "7.142069" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4324" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe Token: SeRestorePrivilege 432 TiWorker.exe Token: SeSecurityPrivilege 432 TiWorker.exe Token: SeBackupPrivilege 432 TiWorker.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2236 2572 c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353.exe 63 PID 2572 wrote to memory of 2236 2572 c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353.exe 63 PID 2572 wrote to memory of 2236 2572 c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353.exe 63 PID 2236 wrote to memory of 2512 2236 cmd.exe 65 PID 2236 wrote to memory of 2512 2236 cmd.exe 65 PID 2236 wrote to memory of 2512 2236 cmd.exe 65 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2512 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353.exe"C:\Users\Admin\AppData\Local\Temp\c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\30282234.bat" "C:\Users\Admin\AppData\Local\Temp\c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\attrib.exeattrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\c1ae38afb6c82b9107868d66318095f1c00f1e92dddc0ee953c23a8de4ace353.exe"3⤵
- Views/modifies file attributes
PID:2512
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3032
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2736
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:432