Analysis
-
max time kernel
153s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 21:37
Behavioral task
behavioral1
Sample
cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe
Resource
win10v2004-20220812-en
General
-
Target
cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe
-
Size
270KB
-
MD5
06ad9e5a069740a4abe6328beeb4e6f2
-
SHA1
664d96aededaa66ee7d1748b4f3155dbde4c4465
-
SHA256
cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20
-
SHA512
b2fef51c8eebfbd507803539c7c28145101e6f78b0980cf041bfc938d66dddb72d896cf233b95c273f0a22641a670558d5f16d2b09fa283864a10c8beb61479d
-
SSDEEP
6144:kWfCbohHv6mC21AAf3os6SC+vyJ65FrD1yyIchVjz5GEKQVfjixoSM:tfuopvBCSfYdN6yE55D1yyIcVPqQVfjh
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe -
Executes dropped EXE 3 IoCs
pid Process 3404 winlogon.exe 1256 winlogon.exe 1304 winlogon.exe -
resource yara_rule upx behavioral2/memory/2520-132-0x0000000000400000-0x000000000058E000-memory.dmp upx behavioral2/files/0x0007000000022e2c-140.dat upx behavioral2/files/0x0007000000022e2c-139.dat upx behavioral2/memory/2520-141-0x0000000000400000-0x000000000058E000-memory.dmp upx behavioral2/memory/1256-145-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/files/0x0007000000022e2c-146.dat upx behavioral2/memory/1256-148-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/3404-151-0x0000000000400000-0x000000000058E000-memory.dmp upx behavioral2/memory/1304-152-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1256-150-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/files/0x0007000000022e2c-154.dat upx behavioral2/memory/1304-156-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3404-160-0x0000000000400000-0x000000000058E000-memory.dmp upx behavioral2/memory/1304-159-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1304-171-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1256-172-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3404 set thread context of 1256 3404 winlogon.exe 87 PID 3404 set thread context of 1304 3404 winlogon.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 4 IoCs
pid Process 224 reg.exe 212 reg.exe 1520 reg.exe 2100 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 1256 winlogon.exe Token: SeCreateTokenPrivilege 1256 winlogon.exe Token: SeAssignPrimaryTokenPrivilege 1256 winlogon.exe Token: SeLockMemoryPrivilege 1256 winlogon.exe Token: SeIncreaseQuotaPrivilege 1256 winlogon.exe Token: SeMachineAccountPrivilege 1256 winlogon.exe Token: SeTcbPrivilege 1256 winlogon.exe Token: SeSecurityPrivilege 1256 winlogon.exe Token: SeTakeOwnershipPrivilege 1256 winlogon.exe Token: SeLoadDriverPrivilege 1256 winlogon.exe Token: SeSystemProfilePrivilege 1256 winlogon.exe Token: SeSystemtimePrivilege 1256 winlogon.exe Token: SeProfSingleProcessPrivilege 1256 winlogon.exe Token: SeIncBasePriorityPrivilege 1256 winlogon.exe Token: SeCreatePagefilePrivilege 1256 winlogon.exe Token: SeCreatePermanentPrivilege 1256 winlogon.exe Token: SeBackupPrivilege 1256 winlogon.exe Token: SeRestorePrivilege 1256 winlogon.exe Token: SeShutdownPrivilege 1256 winlogon.exe Token: SeDebugPrivilege 1256 winlogon.exe Token: SeAuditPrivilege 1256 winlogon.exe Token: SeSystemEnvironmentPrivilege 1256 winlogon.exe Token: SeChangeNotifyPrivilege 1256 winlogon.exe Token: SeRemoteShutdownPrivilege 1256 winlogon.exe Token: SeUndockPrivilege 1256 winlogon.exe Token: SeSyncAgentPrivilege 1256 winlogon.exe Token: SeEnableDelegationPrivilege 1256 winlogon.exe Token: SeManageVolumePrivilege 1256 winlogon.exe Token: SeImpersonatePrivilege 1256 winlogon.exe Token: SeCreateGlobalPrivilege 1256 winlogon.exe Token: 31 1256 winlogon.exe Token: 32 1256 winlogon.exe Token: 33 1256 winlogon.exe Token: 34 1256 winlogon.exe Token: 35 1256 winlogon.exe Token: SeDebugPrivilege 1304 winlogon.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2520 cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe 3404 winlogon.exe 1256 winlogon.exe 1256 winlogon.exe 1304 winlogon.exe 1256 winlogon.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2520 wrote to memory of 3060 2520 cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe 82 PID 2520 wrote to memory of 3060 2520 cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe 82 PID 2520 wrote to memory of 3060 2520 cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe 82 PID 3060 wrote to memory of 4820 3060 cmd.exe 85 PID 3060 wrote to memory of 4820 3060 cmd.exe 85 PID 3060 wrote to memory of 4820 3060 cmd.exe 85 PID 2520 wrote to memory of 3404 2520 cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe 86 PID 2520 wrote to memory of 3404 2520 cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe 86 PID 2520 wrote to memory of 3404 2520 cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe 86 PID 3404 wrote to memory of 1256 3404 winlogon.exe 87 PID 3404 wrote to memory of 1256 3404 winlogon.exe 87 PID 3404 wrote to memory of 1256 3404 winlogon.exe 87 PID 3404 wrote to memory of 1256 3404 winlogon.exe 87 PID 3404 wrote to memory of 1256 3404 winlogon.exe 87 PID 3404 wrote to memory of 1256 3404 winlogon.exe 87 PID 3404 wrote to memory of 1256 3404 winlogon.exe 87 PID 3404 wrote to memory of 1256 3404 winlogon.exe 87 PID 3404 wrote to memory of 1304 3404 winlogon.exe 88 PID 3404 wrote to memory of 1304 3404 winlogon.exe 88 PID 3404 wrote to memory of 1304 3404 winlogon.exe 88 PID 3404 wrote to memory of 1304 3404 winlogon.exe 88 PID 3404 wrote to memory of 1304 3404 winlogon.exe 88 PID 3404 wrote to memory of 1304 3404 winlogon.exe 88 PID 3404 wrote to memory of 1304 3404 winlogon.exe 88 PID 3404 wrote to memory of 1304 3404 winlogon.exe 88 PID 1256 wrote to memory of 1892 1256 winlogon.exe 96 PID 1256 wrote to memory of 1892 1256 winlogon.exe 96 PID 1256 wrote to memory of 1892 1256 winlogon.exe 96 PID 1256 wrote to memory of 1764 1256 winlogon.exe 89 PID 1256 wrote to memory of 1764 1256 winlogon.exe 89 PID 1256 wrote to memory of 1764 1256 winlogon.exe 89 PID 1256 wrote to memory of 2864 1256 winlogon.exe 94 PID 1256 wrote to memory of 2864 1256 winlogon.exe 94 PID 1256 wrote to memory of 2864 1256 winlogon.exe 94 PID 1256 wrote to memory of 4108 1256 winlogon.exe 92 PID 1256 wrote to memory of 4108 1256 winlogon.exe 92 PID 1256 wrote to memory of 4108 1256 winlogon.exe 92 PID 1764 wrote to memory of 212 1764 cmd.exe 98 PID 1764 wrote to memory of 212 1764 cmd.exe 98 PID 1764 wrote to memory of 212 1764 cmd.exe 98 PID 1892 wrote to memory of 224 1892 cmd.exe 97 PID 1892 wrote to memory of 224 1892 cmd.exe 97 PID 1892 wrote to memory of 224 1892 cmd.exe 97 PID 4108 wrote to memory of 2100 4108 cmd.exe 100 PID 4108 wrote to memory of 2100 4108 cmd.exe 100 PID 4108 wrote to memory of 2100 4108 cmd.exe 100 PID 2864 wrote to memory of 1520 2864 cmd.exe 99 PID 2864 wrote to memory of 1520 2864 cmd.exe 99 PID 2864 wrote to memory of 1520 2864 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe"C:\Users\Admin\AppData\Local\Temp\cd57dae9a58bf5093450501890ca2e664c150b5cf88e7a22d492c584f71d3c20.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sAqgD.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Winlogon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe" /f3⤵
- Adds Run key to start application
PID:4820
-
-
-
C:\Users\Admin\AppData\Roaming\winlogon.exe"C:\Users\Admin\AppData\Roaming\winlogon.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Roaming\winlogon.exeC:\Users\Admin\AppData\Roaming\winlogon.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
PID:212
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
PID:2100
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1520
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
PID:224
-
-
-
-
C:\Users\Admin\AppData\Roaming\winlogon.exeC:\Users\Admin\AppData\Roaming\winlogon.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1304
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
138B
MD54da6717f2c70f4bd32ad33a227a2ff47
SHA13d7f7159e1f695bd469287d1ad4ffa0841b407a8
SHA256a12bb2e5d2fb0b3c400ce311fae72995a00b57a97d23e4b9effec47cff189d07
SHA5126765314054ad9bf2164058248f3d3a17775176925abbe4376aec030dca3a5e59be8b9e96139941fec2b2e1a9bff38f87abdb29ea09a299d8ab7e23ecec4083df
-
Filesize
270KB
MD550c712e8394f9bc5d0a7125f0c04962b
SHA118ec1dcacd9d81ed4805e0443d6bffdb1c645ee8
SHA256d0d83ac4c45c9be1d4d169af4fa98c36a776904d60759b7a7cbbddca4c7e7ddf
SHA512713a0dbe4df7576fe45b9633586cb2ff9c7960b866471f38d8ea078b0d940f36e75f96e88a62817136f9eba05d442db5e3b7ce93accda11a48abbdf19684b711
-
Filesize
270KB
MD550c712e8394f9bc5d0a7125f0c04962b
SHA118ec1dcacd9d81ed4805e0443d6bffdb1c645ee8
SHA256d0d83ac4c45c9be1d4d169af4fa98c36a776904d60759b7a7cbbddca4c7e7ddf
SHA512713a0dbe4df7576fe45b9633586cb2ff9c7960b866471f38d8ea078b0d940f36e75f96e88a62817136f9eba05d442db5e3b7ce93accda11a48abbdf19684b711
-
Filesize
270KB
MD550c712e8394f9bc5d0a7125f0c04962b
SHA118ec1dcacd9d81ed4805e0443d6bffdb1c645ee8
SHA256d0d83ac4c45c9be1d4d169af4fa98c36a776904d60759b7a7cbbddca4c7e7ddf
SHA512713a0dbe4df7576fe45b9633586cb2ff9c7960b866471f38d8ea078b0d940f36e75f96e88a62817136f9eba05d442db5e3b7ce93accda11a48abbdf19684b711
-
Filesize
270KB
MD550c712e8394f9bc5d0a7125f0c04962b
SHA118ec1dcacd9d81ed4805e0443d6bffdb1c645ee8
SHA256d0d83ac4c45c9be1d4d169af4fa98c36a776904d60759b7a7cbbddca4c7e7ddf
SHA512713a0dbe4df7576fe45b9633586cb2ff9c7960b866471f38d8ea078b0d940f36e75f96e88a62817136f9eba05d442db5e3b7ce93accda11a48abbdf19684b711