Analysis
-
max time kernel
58s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 12:32
Static task
static1
Behavioral task
behavioral1
Sample
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe
Resource
win7-20221111-en
General
-
Target
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe
-
Size
872KB
-
MD5
583f881b967b4a1215c4c348dbdb0626
-
SHA1
3f67a91c90469f4f50b615615b049b978d695443
-
SHA256
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa
-
SHA512
de14bf49d8c739513eade8b8a1e8327be364cbd99529551d819db026476803328fb7b07513422d9108e23e0f0a06bb79f6525789c794e41e55ebef8df455c54c
-
SSDEEP
24576:aFfuzvR/9l/64o5GX5BvS5iYDCbbTdpPwTs8UT:zTRfFpJSEpPwTs8U
Malware Config
Signatures
-
Processes:
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe -
Processes:
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1116 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.execmd.exedescription pid process target process PID 1336 wrote to memory of 1496 1336 ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe cmd.exe PID 1336 wrote to memory of 1496 1336 ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe cmd.exe PID 1336 wrote to memory of 1496 1336 ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe cmd.exe PID 1336 wrote to memory of 1496 1336 ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe cmd.exe PID 1496 wrote to memory of 1116 1496 cmd.exe sc.exe PID 1496 wrote to memory of 1116 1496 cmd.exe sc.exe PID 1496 wrote to memory of 1116 1496 cmd.exe sc.exe PID 1496 wrote to memory of 1116 1496 cmd.exe sc.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe"C:\Users\Admin\AppData\Local\Temp\ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc config wscsvc start= disabled2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc config wscsvc start= disabled3⤵
- Launches sc.exe