0c8296da5ca468087ecaeac3bb9b4475f075ae0ba654c9cc05a017f96d974d98

General

Target
5673b49b2aea57b5ffce4fd4eb3e5311.exe
Size 455KB
Sample221202-vzbvmagh29
SHA256 0c8296da5ca468087ecaeac3bb9b4475f075ae0ba654c9cc05a017f96d974d98
MD5 5673b49b2aea57b5ffce4fd4eb3e5311
SHA1 ae67e414e4c7f9bfda56938e14f7a9a992abdb80
SHA512 0d5a902c133e2e8fbb2d29aea536b0404c170b68fbcf51f194e37f9f61fee4c23d6c510807658a97673fe66040fcd951b335457c1d785ca655167f4a40d69e4e
SSDEEP 12288:Rxgjr9v7Kg5TFbcZ4C1yjDZZbenSSkmXUIDCYCCHE+STxIU:RxgJ7ZuejDZZben/xXUIDCYCCHE+STxI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5673b49b2aea57b5ffce4fd4eb3e5311.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	5673b49b2aea57b5ffce4fd4eb3e5311.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\5673b49b2aea57b5ffce4fd4eb3e5311.exe = "0"	5673b49b2aea57b5ffce4fd4eb3e5311.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	5673b49b2aea57b5ffce4fd4eb3e5311.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	5673b49b2aea57b5ffce4fd4eb3e5311.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\5673b49b2aea57b5ffce4fd4eb3e5311.exe = "0"	5673b49b2aea57b5ffce4fd4eb3e5311.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	5673b49b2aea57b5ffce4fd4eb3e5311.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	5673b49b2aea57b5ffce4fd4eb3e5311.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5673b49b2aea57b5ffce4fd4eb3e5311.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5673b49b2aea57b5ffce4fd4eb3e5311.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4904	powershell.exe
4904	powershell.exe
2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
Token: SeDebugPrivilege	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
Token: SeLoadDriverPrivilege	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe
Token: SeDebugPrivilege	4904	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 4904	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	80
PID 2936 wrote to memory of 4904	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	80
PID 2936 wrote to memory of 2624	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	82
PID 2936 wrote to memory of 2624	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	82
PID 2936 wrote to memory of 3204	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	83
PID 2936 wrote to memory of 3204	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	83
PID 2936 wrote to memory of 2952	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	84
PID 2936 wrote to memory of 2952	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	84
PID 2936 wrote to memory of 3800	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	85
PID 2936 wrote to memory of 3800	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	85
PID 2936 wrote to memory of 2324	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	86
PID 2936 wrote to memory of 2324	2936	5673b49b2aea57b5ffce4fd4eb3e5311.exe	86

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5673b49b2aea57b5ffce4fd4eb3e5311.exe

C:\Users\Admin\AppData\Local\Temp\5673b49b2aea57b5ffce4fd4eb3e5311.exe
"C:\Users\Admin\AppData\Local\Temp\5673b49b2aea57b5ffce4fd4eb3e5311.exe"
1⤵
- UAC bypass
- Windows security bypass
- Sets service image path in registry
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5673b49b2aea57b5ffce4fd4eb3e5311.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:3800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2324