Analysis
- max time kernel
151s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
14/10/2022, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
General
- Target 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe
- Size 868KB
- Sample221014-e1zp3sgbfn
- SHA256 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8
- MD5 6173506ce25850fc82e96763ff7a85eb
- SHA1 510f1cdc950e9d50c6eb4de8b0dd523804098ead
- SHA512 e6fd94c34edeff2cc724c34de50ee2182e82744e5c76e99eabaf014ab6a9f898c1aee54d07a3929183d5780873e1fb1671298243edf4817b2481288f36c82ef5
- SSDEEP 12288:NfpLmjjVvJsHVBMurYNxxHgiY/Std15tkm+1ubOa0NCtOkQqYiItDmOl5KHv8:11EskrxHgiY/yTtk+bOVeSlD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Services\\service.exe" 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe - Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile service.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" service.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" service.exe - Executes dropped EXE 3 IoCs
pid Process 556 service.exe 3060 service.exe 2984 service.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate service.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\Services\\service.exe" 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run service.exe - Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe File opened for modification \??\PhysicalDrive0 service.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 5044 set thread context of 2228 5044 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 87 PID 2228 set thread context of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 556 set thread context of 3060 556 service.exe 93 PID 3060 set thread context of 2984 3060 service.exe 94 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 service.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString service.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier service.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier service.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier service.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeSecurityPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeTakeOwnershipPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeLoadDriverPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeSystemProfilePrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeSystemtimePrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeProfSingleProcessPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeIncBasePriorityPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeCreatePagefilePrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeBackupPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeRestorePrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeShutdownPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeDebugPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeSystemEnvironmentPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeChangeNotifyPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeRemoteShutdownPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeUndockPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeManageVolumePrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeImpersonatePrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeCreateGlobalPrivilege 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: 33 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: 34 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: 35 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: 36 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe Token: SeIncreaseQuotaPrivilege 2984 service.exe Token: SeSecurityPrivilege 2984 service.exe Token: SeTakeOwnershipPrivilege 2984 service.exe Token: SeLoadDriverPrivilege 2984 service.exe Token: SeSystemProfilePrivilege 2984 service.exe Token: SeSystemtimePrivilege 2984 service.exe Token: SeProfSingleProcessPrivilege 2984 service.exe Token: SeIncBasePriorityPrivilege 2984 service.exe Token: SeCreatePagefilePrivilege 2984 service.exe Token: SeBackupPrivilege 2984 service.exe Token: SeRestorePrivilege 2984 service.exe Token: SeShutdownPrivilege 2984 service.exe Token: SeDebugPrivilege 2984 service.exe Token: SeSystemEnvironmentPrivilege 2984 service.exe Token: SeChangeNotifyPrivilege 2984 service.exe Token: SeRemoteShutdownPrivilege 2984 service.exe Token: SeUndockPrivilege 2984 service.exe Token: SeManageVolumePrivilege 2984 service.exe Token: SeImpersonatePrivilege 2984 service.exe Token: SeCreateGlobalPrivilege 2984 service.exe Token: 33 2984 service.exe Token: 34 2984 service.exe Token: 35 2984 service.exe Token: 36 2984 service.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5044 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 556 service.exe 3060 service.exe - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 5044 wrote to memory of 2228 5044 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 87 PID 5044 wrote to memory of 2228 5044 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 87 PID 5044 wrote to memory of 2228 5044 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 87 PID 5044 wrote to memory of 2228 5044 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 87 PID 5044 wrote to memory of 2228 5044 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 87 PID 5044 wrote to memory of 2228 5044 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 87 PID 5044 wrote to memory of 2228 5044 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 87 PID 5044 wrote to memory of 2228 5044 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 87 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 2228 wrote to memory of 1380 2228 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 88 PID 1380 wrote to memory of 556 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 90 PID 1380 wrote to memory of 556 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 90 PID 1380 wrote to memory of 556 1380 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe 90 PID 556 wrote to memory of 3060 556 service.exe 93 PID 556 wrote to memory of 3060 556 service.exe 93 PID 556 wrote to memory of 3060 556 service.exe 93 PID 556 wrote to memory of 3060 556 service.exe 93 PID 556 wrote to memory of 3060 556 service.exe 93 PID 556 wrote to memory of 3060 556 service.exe 93 PID 556 wrote to memory of 3060 556 service.exe 93 PID 556 wrote to memory of 3060 556 service.exe 93 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94 PID 3060 wrote to memory of 2984 3060 service.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe"C:\Users\Admin\AppData\Local\Temp\281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe"C:\Users\Admin\AppData\Local\Temp\281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe"C:\Users\Admin\AppData\Local\Temp\281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8.exe"3⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Roaming\Services\service.exe"C:\Users\Admin\AppData\Roaming\Services\service.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Roaming\Services\service.exe"C:\Users\Admin\AppData\Roaming\Services\service.exe"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Roaming\Services\service.exe"C:\Users\Admin\AppData\Roaming\Services\service.exe"6⤵
- Modifies firewall policy service
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Services\service.exe
- Size 868KB
- SHA256 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8
- MD5 6173506ce25850fc82e96763ff7a85eb
- SHA1 510f1cdc950e9d50c6eb4de8b0dd523804098ead
- SHA512 e6fd94c34edeff2cc724c34de50ee2182e82744e5c76e99eabaf014ab6a9f898c1aee54d07a3929183d5780873e1fb1671298243edf4817b2481288f36c82ef5
- SSDEEP 12288:NfpLmjjVvJsHVBMurYNxxHgiY/Std15tkm+1ubOa0NCtOkQqYiItDmOl5KHv8:11EskrxHgiY/yTtk+bOVeSlD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Services\service.exe
- Size 868KB
- SHA256 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8
- MD5 6173506ce25850fc82e96763ff7a85eb
- SHA1 510f1cdc950e9d50c6eb4de8b0dd523804098ead
- SHA512 e6fd94c34edeff2cc724c34de50ee2182e82744e5c76e99eabaf014ab6a9f898c1aee54d07a3929183d5780873e1fb1671298243edf4817b2481288f36c82ef5
- SSDEEP 12288:NfpLmjjVvJsHVBMurYNxxHgiY/Std15tkm+1ubOa0NCtOkQqYiItDmOl5KHv8:11EskrxHgiY/yTtk+bOVeSlD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Services\service.exe
- Size 868KB
- SHA256 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8
- MD5 6173506ce25850fc82e96763ff7a85eb
- SHA1 510f1cdc950e9d50c6eb4de8b0dd523804098ead
- SHA512 e6fd94c34edeff2cc724c34de50ee2182e82744e5c76e99eabaf014ab6a9f898c1aee54d07a3929183d5780873e1fb1671298243edf4817b2481288f36c82ef5
- SSDEEP 12288:NfpLmjjVvJsHVBMurYNxxHgiY/Std15tkm+1ubOa0NCtOkQqYiItDmOl5KHv8:11EskrxHgiY/yTtk+bOVeSlD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Services\service.exe
- Size 868KB
- SHA256 281dc888a8fab70e6fdc8f429e84e44d8262b8109441618e43a01527d62765a8
- MD5 6173506ce25850fc82e96763ff7a85eb
- SHA1 510f1cdc950e9d50c6eb4de8b0dd523804098ead
- SHA512 e6fd94c34edeff2cc724c34de50ee2182e82744e5c76e99eabaf014ab6a9f898c1aee54d07a3929183d5780873e1fb1671298243edf4817b2481288f36c82ef5
- SSDEEP 12288:NfpLmjjVvJsHVBMurYNxxHgiY/Std15tkm+1ubOa0NCtOkQqYiItDmOl5KHv8:11EskrxHgiY/yTtk+bOVeSlD
- MD5 SHA1 SHA512 SSDEEP