21ddbef7a8d998786b0b7acf5677fecf35bd7cc00b973850b6709671c3fff37a

General

Target

21ddbef7a8d998786b0b7acf5677fecf35bd7cc00b973850b6709671c3fff37a.exe
Size

235KB
MD5

4b53491b53623cc0a8616eaedea6f81c
SHA1

db2ea45c85e25dedf3e4a332b3bcd2b94e12ac3f
SHA256

21ddbef7a8d998786b0b7acf5677fecf35bd7cc00b973850b6709671c3fff37a
SHA512

01a2de0218babfa5a280fcd77a6a1ad681b124b2836b113cb161255b94ce13060b11412a26052b2cfda002b62e20c4d64fc76aa48941b9eb763d54ee0b1e109d

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

21ddbef7a8d998786b0b7acf5677fecf35bd7cc00b973850b6709671c3fff37a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	21ddbef7a8d998786b0b7acf5677fecf35bd7cc00b973850b6709671c3fff37a.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File Permissions Modification

T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	process
864	icacls.exe
1680	icacls.exe
2404	icacls.exe
2324	icacls.exe
3404	icacls.exe
4820	icacls.exe
2668	icacls.exe
3288	icacls.exe
1048	icacls.exe
996	icacls.exe
908	icacls.exe
3596	icacls.exe
1364	icacls.exe
4776	icacls.exe
1912	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 8 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2876 taskkill.exe
4220 taskkill.exe
3176 taskkill.exe
448 taskkill.exe
552 taskkill.exe
760 taskkill.exe
4304 taskkill.exe
4320 taskkill.exe

pid	process
2876	taskkill.exe
4220	taskkill.exe
3176	taskkill.exe
448	taskkill.exe
552	taskkill.exe
760	taskkill.exe
4304	taskkill.exe
4320	taskkill.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4220	taskkill.exe
Token: SeDebugPrivilege	3176	taskkill.exe
Token: SeDebugPrivilege	448	taskkill.exe
Token: SeDebugPrivilege	552	taskkill.exe
Token: SeDebugPrivilege	760	taskkill.exe
Token: SeDebugPrivilege	4304	taskkill.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeDebugPrivilege	2876	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

21ddbef7a8d998786b0b7acf5677fecf35bd7cc00b973850b6709671c3fff37a.execmd.exe

description	pid	process	target process
PID 768 wrote to memory of 3312	768	21ddbef7a8d998786b0b7acf5677fecf35bd7cc00b973850b6709671c3fff37a.exe	cmd.exe
PID 768 wrote to memory of 3312	768	21ddbef7a8d998786b0b7acf5677fecf35bd7cc00b973850b6709671c3fff37a.exe	cmd.exe
PID 3312 wrote to memory of 4220	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 4220	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 3176	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 3176	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 448	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 448	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 552	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 552	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 760	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 760	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 4304	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 4304	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 4320	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 4320	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 2876	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 2876	3312	cmd.exe	taskkill.exe
PID 3312 wrote to memory of 4208	3312	cmd.exe	attrib.exe
PID 3312 wrote to memory of 4208	3312	cmd.exe	attrib.exe
PID 3312 wrote to memory of 864	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 864	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 996	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 996	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 2324	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 2324	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 1680	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 1680	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 2668	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 2668	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 2256	3312	cmd.exe	attrib.exe
PID 3312 wrote to memory of 2256	3312	cmd.exe	attrib.exe
PID 3312 wrote to memory of 2404	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 2404	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 3404	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 3404	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 3288	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 3288	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 908	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 908	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 3596	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 3596	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 1256	3312	cmd.exe	attrib.exe
PID 3312 wrote to memory of 1256	3312	cmd.exe	attrib.exe
PID 3312 wrote to memory of 1364	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 1364	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 4820	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 4820	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 4776	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 4776	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 1912	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 1912	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 1048	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 1048	3312	cmd.exe	icacls.exe
PID 3312 wrote to memory of 4340	3312	cmd.exe	reg.exe
PID 3312 wrote to memory of 4340	3312	cmd.exe	reg.exe
PID 3312 wrote to memory of 4940	3312	cmd.exe	reg.exe
PID 3312 wrote to memory of 4940	3312	cmd.exe	reg.exe
PID 3312 wrote to memory of 2120	3312	cmd.exe	reg.exe
PID 3312 wrote to memory of 2120	3312	cmd.exe	reg.exe
PID 3312 wrote to memory of 2820	3312	cmd.exe	reg.exe
PID 3312 wrote to memory of 2820	3312	cmd.exe	reg.exe
PID 3312 wrote to memory of 2160	3312	cmd.exe	reg.exe
PID 3312 wrote to memory of 2160	3312	cmd.exe	reg.exe

Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exe

pid process

4208 attrib.exe
2256 attrib.exe
1256 attrib.exe

pid	process
4208	attrib.exe
2256	attrib.exe
1256	attrib.exe

C:\Users\Admin\AppData\Local\Temp\21ddbef7a8d998786b0b7acf5677fecf35bd7cc00b973850b6709671c3fff37a.exe
"C:\Users\Admin\AppData\Local\Temp\21ddbef7a8d998786b0b7acf5677fecf35bd7cc00b973850b6709671c3fff37a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\80FC.tmp\80FD.tmp\80FE.bat C:\Users\Admin\AppData\Local\Temp\21ddbef7a8d998786b0b7acf5677fecf35bd7cc00b973850b6709671c3fff37a.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3312

C:\Windows\system32\taskkill.exe
taskkill /f /IM IntelConfigService.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Windows\system32\taskkill.exe
taskkill /f /IM msexec.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\system32\taskkill.exe
taskkill /f /IM cftmon.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:448

C:\Windows\system32\taskkill.exe
taskkill /f /IM ntosknl.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Windows\system32\taskkill.exe
taskkill /f /IM sqlserver.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Windows\system32\taskkill.exe
taskkill /f /IM xCoreManagment.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\system32\taskkill.exe
taskkill /f /IM ApplicationsFrameHost.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\system32\taskkill.exe
taskkill /f /IM Wrap.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\system32\attrib.exe
attrib "C:\ProgramData\MicrosoftUpdateManager" -s -h -r /S /D
3⤵
- Views/modifies file attributes
PID:4208

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\MicrosoftUpdateManager" /inheritance:e /grant "*S-1-1-0:(R,REA,RA,RD)" "*S-1-5-7:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:864

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\MicrosoftUpdateManager" /inheritance:e /grant "SYSTEM:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:996

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\MicrosoftUpdateManager" /inheritance:e /grant "Administrators:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:2324

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\MicrosoftUpdateManager" /inheritance:e /grant "Users:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:1680

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\MicrosoftUpdateManager" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:2668

C:\Windows\system32\attrib.exe
attrib "C:\ProgramData\WindowsBackup" -s -h -r /S /D
3⤵
- Views/modifies file attributes
PID:2256

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\WindowsBackup" /inheritance:e /grant "*S-1-1-0:(R,REA,RA,RD)" "*S-1-5-7:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:2404

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\WindowsBackup" /inheritance:e /grant "SYSTEM:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:3404

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\WindowsBackup" /inheritance:e /grant "Administrators:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:3288

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\WindowsBackup" /inheritance:e /grant "Users:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:908

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\WindowsBackup" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:3596

C:\Windows\system32\attrib.exe
attrib "C:\ProgramData\IntelCore" -s -h -r /S /D
3⤵
- Views/modifies file attributes
PID:1256

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\IntelCore" /inheritance:e /grant "*S-1-1-0:(R,REA,RA,RD)" "*S-1-5-7:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:1364

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\IntelCore" /inheritance:e /grant "SYSTEM:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:4820

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\IntelCore" /inheritance:e /grant "Administrators:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:4776

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\IntelCore" /inheritance:e /grant "Users:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:1912

C:\Windows\system32\icacls.exe
icacls "C:\ProgramData\IntelCore" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
3⤵
- Modifies file permissions
PID:1048

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v Windows Update Manager /F
3⤵
PID:4340

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Windows Update Manager /F
3⤵
PID:4940

C:\Windows\system32\reg.exe
REG DELETE HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Windows Update Manager /F
3⤵
PID:2120

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v System /F
3⤵
PID:2820

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v System /F
3⤵
PID:2160

C:\Windows\system32\reg.exe
REG DELETE HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v System /F
3⤵
PID:4624

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v Windows Start-Up Application /F
3⤵
PID:3240

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Windows Start-Up Application /F
3⤵
PID:4548

C:\Windows\system32\reg.exe
REG DELETE HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Windows Start-Up Application /F
3⤵
PID:4504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\80FC.tmp\80FD.tmp\80FE.bat
Filesize
2KB

MD5
b8c26dc9560c1406c0738ca755dc3caf

SHA1
05993ce61ba127b1bc72006d826561974c1046bb

SHA256
1e7fe4fd0c12a3e4577634b1dc2fc75c7579cd23d6eab9f5f22f18c6eb22514a

SHA512
e59cce1ca34b363586a4cd778fc0121b19d29af270285b813f219f0582f71f14e13a8aab3f130703664cdc9a2ed962e394684f81e3cd865a307726996091998a

Download Submit
memory/448-134-0x0000000000000000-mapping.dmp

Download
memory/552-135-0x0000000000000000-mapping.dmp

Download
memory/760-136-0x0000000000000000-mapping.dmp

Download
memory/864-141-0x0000000000000000-mapping.dmp

Download
memory/908-150-0x0000000000000000-mapping.dmp

Download
memory/996-142-0x0000000000000000-mapping.dmp

Download
memory/1048-157-0x0000000000000000-mapping.dmp

Download
memory/1256-152-0x0000000000000000-mapping.dmp

Download
memory/1364-153-0x0000000000000000-mapping.dmp

Download
memory/1680-144-0x0000000000000000-mapping.dmp

Download
memory/1912-156-0x0000000000000000-mapping.dmp

Download
memory/2120-160-0x0000000000000000-mapping.dmp

Download
memory/2160-162-0x0000000000000000-mapping.dmp

Download
memory/2256-146-0x0000000000000000-mapping.dmp

Download
memory/2324-143-0x0000000000000000-mapping.dmp

Download
memory/2404-147-0x0000000000000000-mapping.dmp

Download
memory/2668-145-0x0000000000000000-mapping.dmp

Download
memory/2820-161-0x0000000000000000-mapping.dmp

Download
memory/2876-139-0x0000000000000000-mapping.dmp

Download
memory/3176-133-0x0000000000000000-mapping.dmp

Download
memory/3240-164-0x0000000000000000-mapping.dmp

Download
memory/3288-149-0x0000000000000000-mapping.dmp

Download
memory/3312-130-0x0000000000000000-mapping.dmp

Download
memory/3404-148-0x0000000000000000-mapping.dmp

Download
memory/3596-151-0x0000000000000000-mapping.dmp

Download
memory/4208-140-0x0000000000000000-mapping.dmp

Download
memory/4220-132-0x0000000000000000-mapping.dmp

Download
memory/4304-137-0x0000000000000000-mapping.dmp

Download
memory/4320-138-0x0000000000000000-mapping.dmp

Download
memory/4340-158-0x0000000000000000-mapping.dmp

Download
memory/4504-166-0x0000000000000000-mapping.dmp

Download
memory/4548-165-0x0000000000000000-mapping.dmp

Download
memory/4624-163-0x0000000000000000-mapping.dmp

Download
memory/4776-155-0x0000000000000000-mapping.dmp

Download
memory/4820-154-0x0000000000000000-mapping.dmp

Download
memory/4940-159-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads