Analysis
-
max time kernel
158s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-04-2022 15:52
Behavioral task
behavioral1
Sample
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe
Resource
win7-20220414-en
General
-
Target
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe
-
Size
283KB
-
MD5
6bf6d7d7e70cd737716b614f9008417b
-
SHA1
0c1996ccb192acd5ead43954cc984480fb18d910
-
SHA256
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78
-
SHA512
6999c3f15f7b1c7231990f24c4dbae31ca9fb4faeddc337edfb5e6644f588ddcc103875d2746b7e3852bded61e8024cf2e5b41c1aef0ce05d5ba711c74474d33
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe" 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe -
Executes dropped EXE 1 IoCs
Processes:
system.exepid process 1356 system.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\system.exe upx C:\Users\Admin\AppData\Local\Temp\system.exe upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exesystem.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe" 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe" system.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
system.exepid process 1356 system.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exesystem.exedescription pid process Token: SeIncreaseQuotaPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeSecurityPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeTakeOwnershipPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeLoadDriverPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeSystemProfilePrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeSystemtimePrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeProfSingleProcessPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeIncBasePriorityPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeCreatePagefilePrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeBackupPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeRestorePrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeShutdownPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeDebugPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeSystemEnvironmentPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeChangeNotifyPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeRemoteShutdownPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeUndockPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeManageVolumePrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeImpersonatePrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeCreateGlobalPrivilege 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: 33 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: 34 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: 35 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: 36 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe Token: SeIncreaseQuotaPrivilege 1356 system.exe Token: SeSecurityPrivilege 1356 system.exe Token: SeTakeOwnershipPrivilege 1356 system.exe Token: SeLoadDriverPrivilege 1356 system.exe Token: SeSystemProfilePrivilege 1356 system.exe Token: SeSystemtimePrivilege 1356 system.exe Token: SeProfSingleProcessPrivilege 1356 system.exe Token: SeIncBasePriorityPrivilege 1356 system.exe Token: SeCreatePagefilePrivilege 1356 system.exe Token: SeBackupPrivilege 1356 system.exe Token: SeRestorePrivilege 1356 system.exe Token: SeShutdownPrivilege 1356 system.exe Token: SeDebugPrivilege 1356 system.exe Token: SeSystemEnvironmentPrivilege 1356 system.exe Token: SeChangeNotifyPrivilege 1356 system.exe Token: SeRemoteShutdownPrivilege 1356 system.exe Token: SeUndockPrivilege 1356 system.exe Token: SeManageVolumePrivilege 1356 system.exe Token: SeImpersonatePrivilege 1356 system.exe Token: SeCreateGlobalPrivilege 1356 system.exe Token: 33 1356 system.exe Token: 34 1356 system.exe Token: 35 1356 system.exe Token: 36 1356 system.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
system.exepid process 1356 system.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.execmd.execmd.exesystem.exedescription pid process target process PID 1132 wrote to memory of 4904 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1132 wrote to memory of 4904 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1132 wrote to memory of 4904 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1132 wrote to memory of 1868 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1132 wrote to memory of 1868 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1132 wrote to memory of 1868 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe cmd.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1132 wrote to memory of 2320 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe notepad.exe PID 1868 wrote to memory of 1572 1868 cmd.exe attrib.exe PID 1868 wrote to memory of 1572 1868 cmd.exe attrib.exe PID 1868 wrote to memory of 1572 1868 cmd.exe attrib.exe PID 4904 wrote to memory of 2552 4904 cmd.exe attrib.exe PID 4904 wrote to memory of 2552 4904 cmd.exe attrib.exe PID 4904 wrote to memory of 2552 4904 cmd.exe attrib.exe PID 1132 wrote to memory of 1356 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe system.exe PID 1132 wrote to memory of 1356 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe system.exe PID 1132 wrote to memory of 1356 1132 9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe system.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe PID 1356 wrote to memory of 3816 1356 system.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1572 attrib.exe 2552 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe"C:\Users\Admin\AppData\Local\Temp\9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\9a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
-
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
283KB
MD56bf6d7d7e70cd737716b614f9008417b
SHA10c1996ccb192acd5ead43954cc984480fb18d910
SHA2569a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78
SHA5126999c3f15f7b1c7231990f24c4dbae31ca9fb4faeddc337edfb5e6644f588ddcc103875d2746b7e3852bded61e8024cf2e5b41c1aef0ce05d5ba711c74474d33
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
283KB
MD56bf6d7d7e70cd737716b614f9008417b
SHA10c1996ccb192acd5ead43954cc984480fb18d910
SHA2569a967774e134d423ea04e8079d5236c8363422de1bd4e3e066168df9ccd54e78
SHA5126999c3f15f7b1c7231990f24c4dbae31ca9fb4faeddc337edfb5e6644f588ddcc103875d2746b7e3852bded61e8024cf2e5b41c1aef0ce05d5ba711c74474d33
-
memory/1356-135-0x0000000000000000-mapping.dmp
-
memory/1572-133-0x0000000000000000-mapping.dmp
-
memory/1868-131-0x0000000000000000-mapping.dmp
-
memory/2320-132-0x0000000000000000-mapping.dmp
-
memory/2552-134-0x0000000000000000-mapping.dmp
-
memory/3816-138-0x0000000000000000-mapping.dmp
-
memory/4904-130-0x0000000000000000-mapping.dmp