Analysis
- max time kernel
178s - max time network
386s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
16/06/2022, 17:14
Static task
static1
Behavioral task
behavioral1
Sample
fFFbCKkLBFM.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fFFbCKkLBFM.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target fFFbCKkLBFM.exe
- Size 414.0MB
- Sample220616-vsblaagcbr
- SHA256 e3f6504c16cd226e6d9bf2978930b56806538e9d441e1947bda2317bd50e3fcd
- MD5 ae77db565532122e3cc43349d4ddd306
- SHA1 ffbcd918a0ca2803cdf581520501eeb29392f28c
- SHA512 d5a9f67bd95a823986b4ccbc556f76ab840d14530c7a8a65e0487365850ec69eff2648a903a01983f9d169a0d6f78389b2674f8680a92c49a649a036f646931c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation fFFbCKkLBFM.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run fFFbCKkLBFM.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ASUSTek_VWB38A1G32B3M4V37P8TM7BO1UUI6M = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fFFbCKkLBFM.exe" fFFbCKkLBFM.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ASUSTek_O355027LT6F2PTAUQ0343T617 = "cmd.exe /c start C:\\Users\\Admin\\AppData\\Local\\Temp\\fFFbCKkLBFM.exe" fFFbCKkLBFM.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: fFFbCKkLBFM.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ipinfo.io - Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum fFFbCKkLBFM.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count fFFbCKkLBFM.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 fFFbCKkLBFM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "126" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe 1344 fFFbCKkLBFM.exe - Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeDebugPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: 33 1344 fFFbCKkLBFM.exe Token: SeIncBasePriorityPrivilege 1344 fFFbCKkLBFM.exe Token: SeShutdownPrivilege 1344 fFFbCKkLBFM.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1920 LogonUI.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1344 wrote to memory of 1144 1344 fFFbCKkLBFM.exe 89 PID 1344 wrote to memory of 1144 1344 fFFbCKkLBFM.exe 89 PID 1344 wrote to memory of 1144 1344 fFFbCKkLBFM.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\fFFbCKkLBFM.exe"C:\Users\Admin\AppData\Local\Temp\fFFbCKkLBFM.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn ""2⤵PID:1144
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39cd055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1920