d86bc814e4ba746e0a25e7d84e9bcb09a24d823c4399b67987fa499d15bc8296

Analysis

max time kernel
134s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03/06/2022, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.exe
Size

232KB
MD5

cebcd8313ba1ac74b30bc1c81a3a3a8f
SHA1

529a5e8f55a418db2ea054dc17bd63eaf6603b99
SHA256

1fd2d0c7d504be306ecaaf6e852142ca053950c386e3fd6ee8a1f2138ed89312
SHA512

6a9b3d4be974fcaa987f264db24d547254175b55b0df7767aacbae1890344b412a22819b2aab7da1e9f6aefaf665a2c32b6495d1872e4b67a83b30416701d3c3

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	sample.exe

Modifies file permissions 1 TTPs 19 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
644	takeown.exe
2240	takeown.exe
4708	takeown.exe
4732	takeown.exe
368	takeown.exe
3140	takeown.exe
5096	takeown.exe
4156	takeown.exe
956	takeown.exe
4412	takeown.exe
4860	takeown.exe
3836	takeown.exe
4452	takeown.exe
2768	takeown.exe
1388	takeown.exe
648	takeown.exe
3668	takeown.exe
2044	takeown.exe
2708	takeown.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	sample.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	sample.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3836	2104	sample.exe	81
PID 2104 wrote to memory of 3836	2104	sample.exe	81
PID 2104 wrote to memory of 4156	2104	sample.exe	83
PID 2104 wrote to memory of 4156	2104	sample.exe	83
PID 2104 wrote to memory of 2044	2104	sample.exe	85
PID 2104 wrote to memory of 2044	2104	sample.exe	85
PID 2104 wrote to memory of 4452	2104	sample.exe	87
PID 2104 wrote to memory of 4452	2104	sample.exe	87
PID 2104 wrote to memory of 4708	2104	sample.exe	90
PID 2104 wrote to memory of 4708	2104	sample.exe	90
PID 2104 wrote to memory of 956	2104	sample.exe	91
PID 2104 wrote to memory of 956	2104	sample.exe	91
PID 2104 wrote to memory of 2708	2104	sample.exe	93
PID 2104 wrote to memory of 2708	2104	sample.exe	93
PID 2104 wrote to memory of 2768	2104	sample.exe	95
PID 2104 wrote to memory of 2768	2104	sample.exe	95
PID 2104 wrote to memory of 4412	2104	sample.exe	98
PID 2104 wrote to memory of 4412	2104	sample.exe	98
PID 2104 wrote to memory of 4732	2104	sample.exe	99
PID 2104 wrote to memory of 4732	2104	sample.exe	99
PID 2104 wrote to memory of 644	2104	sample.exe	101
PID 2104 wrote to memory of 644	2104	sample.exe	101
PID 2104 wrote to memory of 1388	2104	sample.exe	103
PID 2104 wrote to memory of 1388	2104	sample.exe	103
PID 2104 wrote to memory of 2240	2104	sample.exe	105
PID 2104 wrote to memory of 2240	2104	sample.exe	105
PID 2104 wrote to memory of 368	2104	sample.exe	107
PID 2104 wrote to memory of 368	2104	sample.exe	107
PID 2104 wrote to memory of 4860	2104	sample.exe	109
PID 2104 wrote to memory of 4860	2104	sample.exe	109
PID 2104 wrote to memory of 648	2104	sample.exe	111
PID 2104 wrote to memory of 648	2104	sample.exe	111
PID 2104 wrote to memory of 3140	2104	sample.exe	113
PID 2104 wrote to memory of 3140	2104	sample.exe	113
PID 2104 wrote to memory of 5096	2104	sample.exe	115
PID 2104 wrote to memory of 5096	2104	sample.exe	115
PID 2104 wrote to memory of 3668	2104	sample.exe	117
PID 2104 wrote to memory of 3668	2104	sample.exe	117

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT
  2⤵
  - Modifies file permissions
  PID:3836
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.dat.LOG1
  2⤵
  - Modifies file permissions
  PID:4156
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.dat.LOG2
  2⤵
  - Modifies file permissions
  PID:2044
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf
  2⤵
  - Modifies file permissions
  PID:4452
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
  2⤵
  - Modifies file permissions
  PID:4708
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
  2⤵
  - Modifies file permissions
  PID:956
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.ini
  2⤵
  - Modifies file permissions
  PID:2708
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
  2⤵
  - Modifies file permissions
  PID:2768
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\3D Objects\desktop.ini
  2⤵
  - Modifies file permissions
  PID:4412
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\IconCache.db
  2⤵
  - Modifies file permissions
  PID:4732
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst
  2⤵
  - Modifies file permissions
  PID:644
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst
  2⤵
  - Modifies file permissions
  PID:1388
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat
  2⤵
  - Modifies file permissions
  PID:2240
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
  2⤵
  - Modifies file permissions
  PID:368
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin
  2⤵
  - Modifies file permissions
  PID:4860
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst
  2⤵
  - Modifies file permissions
  PID:648
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Color\ACECache11.lst
  2⤵
  - Modifies file permissions
  PID:3140
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc
  2⤵
  - Modifies file permissions
  PID:5096
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc
  2⤵
  - Modifies file permissions
  PID:3668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-151-0x00007FFDCFFD0000-0x00007FFDD0A91000-memory.dmp

Filesize
10.8MB

Download
memory/2104-130-0x0000000000060000-0x000000000009E000-memory.dmp

Filesize
248KB

Download
memory/2104-131-0x00007FFDCFFD0000-0x00007FFDD0A91000-memory.dmp

Filesize
10.8MB

Download