Analysis
-
max time kernel
327s -
max time network
377s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 12:32
Static task
static1
Behavioral task
behavioral1
Sample
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe
Resource
win7-20221111-en
General
-
Target
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe
-
Size
872KB
-
MD5
583f881b967b4a1215c4c348dbdb0626
-
SHA1
3f67a91c90469f4f50b615615b049b978d695443
-
SHA256
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa
-
SHA512
de14bf49d8c739513eade8b8a1e8327be364cbd99529551d819db026476803328fb7b07513422d9108e23e0f0a06bb79f6525789c794e41e55ebef8df455c54c
-
SSDEEP
24576:aFfuzvR/9l/64o5GX5BvS5iYDCbbTdpPwTs8UT:zTRfFpJSEpPwTs8U
Malware Config
Signatures
-
Processes:
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe -
Processes:
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1072 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.execmd.exedescription pid process target process PID 3640 wrote to memory of 2276 3640 ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe cmd.exe PID 3640 wrote to memory of 2276 3640 ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe cmd.exe PID 3640 wrote to memory of 2276 3640 ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe cmd.exe PID 2276 wrote to memory of 1072 2276 cmd.exe sc.exe PID 2276 wrote to memory of 1072 2276 cmd.exe sc.exe PID 2276 wrote to memory of 1072 2276 cmd.exe sc.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe"C:\Users\Admin\AppData\Local\Temp\ab9da9bdb591deca8f8fc5d13c7b504c1ae27fe369448492a52f224331345dfa.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc config wscsvc start= disabled2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc config wscsvc start= disabled3⤵
- Launches sc.exe