Analysis

  • max time kernel
    150s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    14-07-2022 07:14

General

  • Target

    4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe

  • Size

    573KB

  • MD5

    4d8c3bbe432078a30d62aa760079fbcf

  • SHA1

    a58d821eda9181fcd487b08d244bd33a67aad775

  • SHA256

    4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be

  • SHA512

    3312293b27a8a2b412f2888069d933883ab39fd30368bd73990d1146a790ff6b348c424ebf8d73c9f8fb725f03d408b44dd68187977a140e7cd52bfab1a04c0a

Score
10/10

Malware Config

Signatures

  • Luminosity

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe
    "C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4164
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Update\JTKVKVCKFYKCCCGCCTyfuflyfuyuUYFUFUYU" /XML "C:\Users\Admin\AppData\Local\Temp\z161"
      2⤵
      • Creates scheduled task(s)
      PID:4000
    • C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe
      "C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe"
      2⤵
        PID:4432
      • C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe
        "C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe"
        2⤵
          PID:3112
        • C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe
          "C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe"
          2⤵
            PID:4592
          • C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe
            "C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe"
            2⤵
              PID:2268
            • C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe
              "C:\Users\Admin\AppData\Local\Temp\4745f3dc2e5442fa507481521616bf34cce9ffc0cf61aa294270849211b1d1be.exe"
              2⤵
              • Suspicious use of SetWindowsHookEx
              PID:1804

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\z161

            Filesize

            1KB

            MD5

            66f46fc20490fd648d2f79ae51ecf349

            SHA1

            1770d6fc6798d6d634875837deba1d98de936765

            SHA256

            61e9c6917b18fee27c4f90a4d8d94e201b645ba45dbb0aaa5cf6611af51d6b8d

            SHA512

            0ccbc708eae89d8fe2b0e12878905ddb357548855dbc477818dda7c8833e578a272726e0adc260c7bbb328f144d161766ec0844f962ddcce48c8ce1b0031afc9

          • memory/1804-139-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/1804-141-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/1804-143-0x0000000074C60000-0x0000000075211000-memory.dmp

            Filesize

            5.7MB

          • memory/1804-144-0x0000000074C60000-0x0000000075211000-memory.dmp

            Filesize

            5.7MB

          • memory/4164-131-0x0000000074C60000-0x0000000075211000-memory.dmp

            Filesize

            5.7MB

          • memory/4164-130-0x0000000074C60000-0x0000000075211000-memory.dmp

            Filesize

            5.7MB