Analysis
- max time kernel
154s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
26/11/2022, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe
- Size 3.1MB
- Sample221126-219xdafb7v
- SHA256 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212
- MD5 baa0df2b6b9abb65a20f36a63ec570e8
- SHA1 d04bf31a0f2419e00f77a8fab0def33c9f0c82ee
- SHA512 dfe9701a77db1fb02d114467527492c901519373bc4433928987f8745f6a6523298981e3486a17f237a4588540c394c122ecd743de7b3e8e355f11261a9d1e15
- SSDEEP 24576:bPgzDvUm2P+JYGWIT+qL19uPxFijutwz310Rj36Vi6GlY/CG:bPgMm22JYRCLvuPxFrK31i3yjsY/C
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp.exe\"" tmp.exe - Executes dropped EXE 4 IoCs
pid Process 2300 tmp.exe 4792 sysmon.exe 1224 tmp.exe 3808 sysmon.exe - Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System Monitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp.exe\"" tmp.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe File opened for modification C:\Windows\assembly\Desktop.ini bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\clientsvr.exe tmp.exe File opened for modification C:\Windows\SysWOW64\clientsvr.exe tmp.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3080 set thread context of 508 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 82 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe File created C:\Windows\assembly\Desktop.ini bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe File opened for modification C:\Windows\assembly\Desktop.ini bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 4792 sysmon.exe 2300 tmp.exe 2300 tmp.exe 4792 sysmon.exe 4792 sysmon.exe 4792 sysmon.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 508 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 508 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 1224 tmp.exe 1224 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe 2300 tmp.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 508 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe Token: 33 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe Token: SeIncBasePriorityPrivilege 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe Token: SeDebugPrivilege 2300 tmp.exe Token: SeDebugPrivilege 4792 sysmon.exe Token: 33 4792 sysmon.exe Token: SeIncBasePriorityPrivilege 4792 sysmon.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2300 tmp.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3080 wrote to memory of 2300 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 81 PID 3080 wrote to memory of 2300 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 81 PID 3080 wrote to memory of 2300 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 81 PID 3080 wrote to memory of 508 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 82 PID 3080 wrote to memory of 508 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 82 PID 3080 wrote to memory of 508 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 82 PID 3080 wrote to memory of 508 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 82 PID 3080 wrote to memory of 508 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 82 PID 3080 wrote to memory of 508 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 82 PID 3080 wrote to memory of 508 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 82 PID 3080 wrote to memory of 508 3080 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 82 PID 508 wrote to memory of 4792 508 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 83 PID 508 wrote to memory of 4792 508 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 83 PID 508 wrote to memory of 4792 508 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe 83 PID 4792 wrote to memory of 1224 4792 sysmon.exe 84 PID 4792 wrote to memory of 1224 4792 sysmon.exe 84 PID 4792 wrote to memory of 1224 4792 sysmon.exe 84 PID 4792 wrote to memory of 4536 4792 sysmon.exe 85 PID 4792 wrote to memory of 4536 4792 sysmon.exe 85 PID 4792 wrote to memory of 4536 4792 sysmon.exe 85 PID 2300 wrote to memory of 3080 2300 tmp.exe 80 PID 2300 wrote to memory of 3080 2300 tmp.exe 80 PID 2300 wrote to memory of 3080 2300 tmp.exe 80 PID 2300 wrote to memory of 3080 2300 tmp.exe 80 PID 2300 wrote to memory of 3080 2300 tmp.exe 80 PID 2300 wrote to memory of 508 2300 tmp.exe 82 PID 2300 wrote to memory of 508 2300 tmp.exe 82 PID 2300 wrote to memory of 508 2300 tmp.exe 82 PID 2300 wrote to memory of 508 2300 tmp.exe 82 PID 2300 wrote to memory of 508 2300 tmp.exe 82 PID 1224 wrote to memory of 3808 1224 tmp.exe 88 PID 1224 wrote to memory of 3808 1224 tmp.exe 88 PID 1224 wrote to memory of 3808 1224 tmp.exe 88 PID 2300 wrote to memory of 1224 2300 tmp.exe 84 PID 2300 wrote to memory of 1224 2300 tmp.exe 84 PID 2300 wrote to memory of 1224 2300 tmp.exe 84 PID 2300 wrote to memory of 1224 2300 tmp.exe 84 PID 2300 wrote to memory of 1224 2300 tmp.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe"C:\Users\Admin\AppData\Local\Temp\bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
-
-
C:\Users\Admin\AppData\Local\Temp\bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exeC:\Users\Admin\AppData\Local\Temp\bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:508 -
C:\ProgramData\233443\sysmon.exe"C:\ProgramData\233443\sysmon.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\ProgramData\233443\sysmon.exe"C:\ProgramData\233443\sysmon.exe"5⤵
- Executes dropped EXE
PID:3808
-
-
-
C:\ProgramData\233443\sysmon.exeC:\ProgramData\233443\sysmon.exe4⤵PID:4536
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\233443\sysmon.exe
- Size 3.1MB
- SHA256 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212
- MD5 baa0df2b6b9abb65a20f36a63ec570e8
- SHA1 d04bf31a0f2419e00f77a8fab0def33c9f0c82ee
- SHA512 dfe9701a77db1fb02d114467527492c901519373bc4433928987f8745f6a6523298981e3486a17f237a4588540c394c122ecd743de7b3e8e355f11261a9d1e15
- SSDEEP 24576:bPgzDvUm2P+JYGWIT+qL19uPxFijutwz310Rj36Vi6GlY/CG:bPgMm22JYRCLvuPxFrK31i3yjsY/C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\233443\sysmon.exe
- Size 3.1MB
- SHA256 bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212
- MD5 baa0df2b6b9abb65a20f36a63ec570e8
- SHA1 d04bf31a0f2419e00f77a8fab0def33c9f0c82ee
- SHA512 dfe9701a77db1fb02d114467527492c901519373bc4433928987f8745f6a6523298981e3486a17f237a4588540c394c122ecd743de7b3e8e355f11261a9d1e15
- SSDEEP 24576:bPgzDvUm2P+JYGWIT+qL19uPxFijutwz310Rj36Vi6GlY/CG:bPgMm22JYRCLvuPxFrK31i3yjsY/C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\233443\sysmon.exe
- Size 365KB
- SHA256 0fcb0b9c18669cefb3194664752dd0a4b57d1fb79923d433b1133dd99486f9db
- MD5 efb53517cf3879d9909f81d8c4d37c0c
- SHA1 e21a324695d8ebd5b70fb73cb9599a1e4c17c20c
- SHA512 b58ba2ed9541fe04b3e32952475cd5cf8de8caf47ccb19784ba86aa5165f112e8a12b043a0512b4ecc5870542598d62a0f66c8c3701956eb61d836a9e0064ace
- SSDEEP 6144:WXV+JnRQtCJmM+mKwYpzyAtmLbR9JWJWwlU3hJ272Ja2P4337MqjrEVGPjk7ngIk:eAROuRvE+la2P4brEyjk7ngYsP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\233443\sysmon.exe
- Size 365KB
- SHA256 0fcb0b9c18669cefb3194664752dd0a4b57d1fb79923d433b1133dd99486f9db
- MD5 efb53517cf3879d9909f81d8c4d37c0c
- SHA1 e21a324695d8ebd5b70fb73cb9599a1e4c17c20c
- SHA512 b58ba2ed9541fe04b3e32952475cd5cf8de8caf47ccb19784ba86aa5165f112e8a12b043a0512b4ecc5870542598d62a0f66c8c3701956eb61d836a9e0064ace
- SSDEEP 6144:WXV+JnRQtCJmM+mKwYpzyAtmLbR9JWJWwlU3hJ272Ja2P4337MqjrEVGPjk7ngIk:eAROuRvE+la2P4brEyjk7ngYsP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\bbf84fac4f56a7819964d01819b48500d6771dffe999bf0ae7e5e6b71b2cb212.exe.log
- Size 319B
- SHA256 d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03
- MD5 824ba7b7eed8b900a98dd25129c4cd83
- SHA1 54478770b2158000ef365591d42977cb854453a1
- SHA512 ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\sysmon.exe.log
- Size 319B
- SHA256 d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03
- MD5 824ba7b7eed8b900a98dd25129c4cd83
- SHA1 54478770b2158000ef365591d42977cb854453a1
- SHA512 ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\svhost.exe
- Size 52KB
- SHA256 403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
- MD5 a64daca3cfbcd039df3ec29d3eddd001
- SHA1 eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
- SHA512 b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479
- SSDEEP 768:YP2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2UAFRJS8fX:zJv46yoD2BTNz1+M9GLfTw8fX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp.exe
- Size 365KB
- SHA256 0fcb0b9c18669cefb3194664752dd0a4b57d1fb79923d433b1133dd99486f9db
- MD5 efb53517cf3879d9909f81d8c4d37c0c
- SHA1 e21a324695d8ebd5b70fb73cb9599a1e4c17c20c
- SHA512 b58ba2ed9541fe04b3e32952475cd5cf8de8caf47ccb19784ba86aa5165f112e8a12b043a0512b4ecc5870542598d62a0f66c8c3701956eb61d836a9e0064ace
- SSDEEP 6144:WXV+JnRQtCJmM+mKwYpzyAtmLbR9JWJWwlU3hJ272Ja2P4337MqjrEVGPjk7ngIk:eAROuRvE+la2P4brEyjk7ngYsP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp.exe
- Size 365KB
- SHA256 0fcb0b9c18669cefb3194664752dd0a4b57d1fb79923d433b1133dd99486f9db
- MD5 efb53517cf3879d9909f81d8c4d37c0c
- SHA1 e21a324695d8ebd5b70fb73cb9599a1e4c17c20c
- SHA512 b58ba2ed9541fe04b3e32952475cd5cf8de8caf47ccb19784ba86aa5165f112e8a12b043a0512b4ecc5870542598d62a0f66c8c3701956eb61d836a9e0064ace
- SSDEEP 6144:WXV+JnRQtCJmM+mKwYpzyAtmLbR9JWJWwlU3hJ272Ja2P4337MqjrEVGPjk7ngIk:eAROuRvE+la2P4brEyjk7ngYsP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp.exe
- Size 365KB
- SHA256 0fcb0b9c18669cefb3194664752dd0a4b57d1fb79923d433b1133dd99486f9db
- MD5 efb53517cf3879d9909f81d8c4d37c0c
- SHA1 e21a324695d8ebd5b70fb73cb9599a1e4c17c20c
- SHA512 b58ba2ed9541fe04b3e32952475cd5cf8de8caf47ccb19784ba86aa5165f112e8a12b043a0512b4ecc5870542598d62a0f66c8c3701956eb61d836a9e0064ace
- SSDEEP 6144:WXV+JnRQtCJmM+mKwYpzyAtmLbR9JWJWwlU3hJ272Ja2P4337MqjrEVGPjk7ngIk:eAROuRvE+la2P4brEyjk7ngYsP
- MD5 SHA1 SHA512 SSDEEP