Analysis
-
max time kernel
151s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2022 18:19
Static task
static1
Behavioral task
behavioral1
Sample
9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe
Resource
win10v2004-20220812-en
General
-
Target
9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe
-
Size
248KB
-
MD5
7171ee9dda00c1d5ff77a74aaf5a7e20
-
SHA1
5c4a4e5348a42b2940041b451c397c9ec2d672b9
-
SHA256
9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3
-
SHA512
85764d54a990699a9b4d3f36c0475c6ef18f6a9af33e01aef8e448c109240f4a699b314d370af7add2c96d9aac9ff4be24bb6d1cf467bee588e7ea1ca03684dd
-
SSDEEP
3072:KU4f+fkjZt7fF0L2vMCDiu0Y8RxwLRMcR9aBeWvfxLWDwNeWJ2NJucbPvJ1nlYZC:K1i+f3uBmLbR9JWJWAJYJuEvPr
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" repair.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\504848\\repair.exe\"" repair.exe -
Executes dropped EXE 1 IoCs
pid Process 1524 repair.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Mechanic = "\"C:\\ProgramData\\504848\\repair.exe\"" repair.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\clientsvr.exe repair.exe File created C:\Windows\SysWOW64\clientsvr.exe repair.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 4784 9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe 4784 9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe 1524 repair.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4784 9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1524 repair.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1524 repair.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4784 wrote to memory of 1524 4784 9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe 82 PID 4784 wrote to memory of 1524 4784 9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe 82 PID 4784 wrote to memory of 1524 4784 9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe 82 PID 1524 wrote to memory of 4784 1524 repair.exe 80 PID 1524 wrote to memory of 4784 1524 repair.exe 80 PID 1524 wrote to memory of 4784 1524 repair.exe 80 PID 1524 wrote to memory of 4784 1524 repair.exe 80 PID 1524 wrote to memory of 4784 1524 repair.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe"C:\Users\Admin\AppData\Local\Temp\9f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\ProgramData\504848\repair.exe"C:\ProgramData\504848\repair.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD57171ee9dda00c1d5ff77a74aaf5a7e20
SHA15c4a4e5348a42b2940041b451c397c9ec2d672b9
SHA2569f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3
SHA51285764d54a990699a9b4d3f36c0475c6ef18f6a9af33e01aef8e448c109240f4a699b314d370af7add2c96d9aac9ff4be24bb6d1cf467bee588e7ea1ca03684dd
-
Filesize
248KB
MD57171ee9dda00c1d5ff77a74aaf5a7e20
SHA15c4a4e5348a42b2940041b451c397c9ec2d672b9
SHA2569f7ae2627ed3edd7499589c49acfba82b1010ef6bb853d7da2198d117b6f49f3
SHA51285764d54a990699a9b4d3f36c0475c6ef18f6a9af33e01aef8e448c109240f4a699b314d370af7add2c96d9aac9ff4be24bb6d1cf467bee588e7ea1ca03684dd