Analysis
-
max time kernel
153s -
max time network
40s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:41
Behavioral task
behavioral1
Sample
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe
-
Size
690KB
-
MD5
c0261de6f8482d655c503f1010dc8896
-
SHA1
093b6680099771887c91b9b7e8bd1bb9d0900cff
-
SHA256
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8
-
SHA512
1cf854af7421f4ee673eb31de2ddd4102b58abc835a381ff4628e6bb50d313342a7656e77884eca0626d22afaaa643a32d8a0d5de1d88c16aff75bd75fcdee19
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exepid process 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exedescription pid process Token: SeIncreaseQuotaPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeSecurityPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeTakeOwnershipPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeLoadDriverPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeSystemProfilePrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeSystemtimePrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeProfSingleProcessPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeIncBasePriorityPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeCreatePagefilePrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeBackupPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeRestorePrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeShutdownPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeDebugPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeSystemEnvironmentPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeChangeNotifyPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeRemoteShutdownPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeUndockPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeManageVolumePrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeImpersonatePrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeCreateGlobalPrivilege 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: 33 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: 34 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: 35 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exepid process 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.execmd.execmd.exedescription pid process target process PID 1660 wrote to memory of 1932 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 1660 wrote to memory of 1932 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 1660 wrote to memory of 1932 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 1660 wrote to memory of 1932 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 1660 wrote to memory of 1092 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 1660 wrote to memory of 1092 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 1660 wrote to memory of 1092 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 1660 wrote to memory of 1092 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 1092 wrote to memory of 1472 1092 cmd.exe attrib.exe PID 1092 wrote to memory of 1472 1092 cmd.exe attrib.exe PID 1092 wrote to memory of 1472 1092 cmd.exe attrib.exe PID 1092 wrote to memory of 1472 1092 cmd.exe attrib.exe PID 1932 wrote to memory of 608 1932 cmd.exe attrib.exe PID 1932 wrote to memory of 608 1932 cmd.exe attrib.exe PID 1932 wrote to memory of 608 1932 cmd.exe attrib.exe PID 1932 wrote to memory of 608 1932 cmd.exe attrib.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1660 wrote to memory of 1396 1660 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 608 attrib.exe 1472 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe"C:\Users\Admin\AppData\Local\Temp\b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/608-58-0x0000000000000000-mapping.dmp
-
memory/1092-56-0x0000000000000000-mapping.dmp
-
memory/1396-59-0x0000000000000000-mapping.dmp
-
memory/1472-57-0x0000000000000000-mapping.dmp
-
memory/1660-54-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1932-55-0x0000000000000000-mapping.dmp