Analysis
-
max time kernel
172s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:41
Behavioral task
behavioral1
Sample
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe
Resource
win7-20220414-en
General
-
Target
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe
-
Size
690KB
-
MD5
c0261de6f8482d655c503f1010dc8896
-
SHA1
093b6680099771887c91b9b7e8bd1bb9d0900cff
-
SHA256
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8
-
SHA512
1cf854af7421f4ee673eb31de2ddd4102b58abc835a381ff4628e6bb50d313342a7656e77884eca0626d22afaaa643a32d8a0d5de1d88c16aff75bd75fcdee19
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exepid process 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exedescription pid process Token: SeIncreaseQuotaPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeSecurityPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeTakeOwnershipPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeLoadDriverPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeSystemProfilePrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeSystemtimePrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeProfSingleProcessPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeIncBasePriorityPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeCreatePagefilePrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeBackupPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeRestorePrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeShutdownPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeDebugPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeSystemEnvironmentPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeChangeNotifyPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeRemoteShutdownPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeUndockPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeManageVolumePrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeImpersonatePrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: SeCreateGlobalPrivilege 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: 33 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: 34 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: 35 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Token: 36 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exepid process 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.execmd.execmd.exedescription pid process target process PID 5100 wrote to memory of 1112 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 5100 wrote to memory of 1112 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 5100 wrote to memory of 1112 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 5100 wrote to memory of 1180 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 5100 wrote to memory of 1180 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 5100 wrote to memory of 1180 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe cmd.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 1180 wrote to memory of 2740 1180 cmd.exe attrib.exe PID 1180 wrote to memory of 2740 1180 cmd.exe attrib.exe PID 1180 wrote to memory of 2740 1180 cmd.exe attrib.exe PID 1112 wrote to memory of 1816 1112 cmd.exe attrib.exe PID 1112 wrote to memory of 1816 1112 cmd.exe attrib.exe PID 1112 wrote to memory of 1816 1112 cmd.exe attrib.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe PID 5100 wrote to memory of 4788 5100 b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2740 attrib.exe 1816 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe"C:\Users\Admin\AppData\Local\Temp\b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Checks computer location settings
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\b18abeeb054a9f0bb83ec277c93e61b5e00d25a4edc80b1dff39fe1c4de2a5b8.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵