adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702

Analysis

max time kernel
152s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702.exe
Size

291KB
MD5

d1a1b11682ef982700433744f10a8786
SHA1

b5505d33cce7d939ad97c7fe342cd6ecef3e40a9
SHA256

adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702
SHA512

1d2ef41e99120fac69deeb389297bfc02702ae8ac29bfaf899dbf3ecb2ce9d8353821cc0989ddca279beed25c25f494dce652197669f4c67679dfbe72996a3a4
SSDEEP

6144:Hq7a9dWYQ3DsOBRZ+BxQJn/F08HlGa77XQ0I2QjK:DAzsOmQ308HlZ7mK

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdater\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
4824	svchost.exe
4356	svchost.exe
176	svchost.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4624-132-0x0000000000400000-0x000000000051A000-memory.dmp	upx
behavioral2/memory/4624-135-0x0000000000400000-0x000000000051A000-memory.dmp	upx
behavioral2/files/0x0006000000022f65-140.dat	upx
behavioral2/files/0x0006000000022f65-141.dat	upx
behavioral2/memory/4624-144-0x0000000000400000-0x000000000051A000-memory.dmp	upx
behavioral2/memory/4824-145-0x0000000000400000-0x000000000051A000-memory.dmp	upx
behavioral2/memory/4824-146-0x0000000000400000-0x000000000051A000-memory.dmp	upx
behavioral2/memory/4356-148-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/files/0x0006000000022f65-149.dat	upx
behavioral2/files/0x0006000000022f65-154.dat	upx
behavioral2/memory/4356-156-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4356-153-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4824-162-0x0000000000400000-0x000000000051A000-memory.dmp	upx
behavioral2/memory/4356-170-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4356-175-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdater = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdater\\svchost.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4824 set thread context of 4356	4824	svchost.exe	91
PID 4824 set thread context of 176	4824	svchost.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4724	reg.exe
3636	reg.exe
496	reg.exe
3520	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	176	svchost.exe
Token: 1	4356	svchost.exe
Token: SeCreateTokenPrivilege	4356	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	4356	svchost.exe
Token: SeLockMemoryPrivilege	4356	svchost.exe
Token: SeIncreaseQuotaPrivilege	4356	svchost.exe
Token: SeMachineAccountPrivilege	4356	svchost.exe
Token: SeTcbPrivilege	4356	svchost.exe
Token: SeSecurityPrivilege	4356	svchost.exe
Token: SeTakeOwnershipPrivilege	4356	svchost.exe
Token: SeLoadDriverPrivilege	4356	svchost.exe
Token: SeSystemProfilePrivilege	4356	svchost.exe
Token: SeSystemtimePrivilege	4356	svchost.exe
Token: SeProfSingleProcessPrivilege	4356	svchost.exe
Token: SeIncBasePriorityPrivilege	4356	svchost.exe
Token: SeCreatePagefilePrivilege	4356	svchost.exe
Token: SeCreatePermanentPrivilege	4356	svchost.exe
Token: SeBackupPrivilege	4356	svchost.exe
Token: SeRestorePrivilege	4356	svchost.exe
Token: SeShutdownPrivilege	4356	svchost.exe
Token: SeDebugPrivilege	4356	svchost.exe
Token: SeAuditPrivilege	4356	svchost.exe
Token: SeSystemEnvironmentPrivilege	4356	svchost.exe
Token: SeChangeNotifyPrivilege	4356	svchost.exe
Token: SeRemoteShutdownPrivilege	4356	svchost.exe
Token: SeUndockPrivilege	4356	svchost.exe
Token: SeSyncAgentPrivilege	4356	svchost.exe
Token: SeEnableDelegationPrivilege	4356	svchost.exe
Token: SeManageVolumePrivilege	4356	svchost.exe
Token: SeImpersonatePrivilege	4356	svchost.exe
Token: SeCreateGlobalPrivilege	4356	svchost.exe
Token: 31	4356	svchost.exe
Token: 32	4356	svchost.exe
Token: 33	4356	svchost.exe
Token: 34	4356	svchost.exe
Token: 35	4356	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4624	adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702.exe
4824	svchost.exe
4356	svchost.exe
176	svchost.exe
4356	svchost.exe
4356	svchost.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 1684	4624	adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702.exe	78
PID 4624 wrote to memory of 1684	4624	adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702.exe	78
PID 4624 wrote to memory of 1684	4624	adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702.exe	78
PID 1684 wrote to memory of 3540	1684	cmd.exe	82
PID 1684 wrote to memory of 3540	1684	cmd.exe	82
PID 1684 wrote to memory of 3540	1684	cmd.exe	82
PID 4624 wrote to memory of 4824	4624	adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702.exe	83
PID 4624 wrote to memory of 4824	4624	adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702.exe	83
PID 4624 wrote to memory of 4824	4624	adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702.exe	83
PID 4824 wrote to memory of 4356	4824	svchost.exe	91
PID 4824 wrote to memory of 4356	4824	svchost.exe	91
PID 4824 wrote to memory of 4356	4824	svchost.exe	91
PID 4824 wrote to memory of 4356	4824	svchost.exe	91
PID 4824 wrote to memory of 4356	4824	svchost.exe	91
PID 4824 wrote to memory of 4356	4824	svchost.exe	91
PID 4824 wrote to memory of 4356	4824	svchost.exe	91
PID 4824 wrote to memory of 4356	4824	svchost.exe	91
PID 4824 wrote to memory of 176	4824	svchost.exe	92
PID 4824 wrote to memory of 176	4824	svchost.exe	92
PID 4824 wrote to memory of 176	4824	svchost.exe	92
PID 4824 wrote to memory of 176	4824	svchost.exe	92
PID 4824 wrote to memory of 176	4824	svchost.exe	92
PID 4824 wrote to memory of 176	4824	svchost.exe	92
PID 4824 wrote to memory of 176	4824	svchost.exe	92
PID 4356 wrote to memory of 4052	4356	svchost.exe	93
PID 4356 wrote to memory of 4052	4356	svchost.exe	93
PID 4356 wrote to memory of 4052	4356	svchost.exe	93
PID 4356 wrote to memory of 1256	4356	svchost.exe	98
PID 4356 wrote to memory of 1256	4356	svchost.exe	98
PID 4356 wrote to memory of 1256	4356	svchost.exe	98
PID 4356 wrote to memory of 4588	4356	svchost.exe	94
PID 4356 wrote to memory of 4588	4356	svchost.exe	94
PID 4356 wrote to memory of 4588	4356	svchost.exe	94
PID 4356 wrote to memory of 1632	4356	svchost.exe	95
PID 4356 wrote to memory of 1632	4356	svchost.exe	95
PID 4356 wrote to memory of 1632	4356	svchost.exe	95
PID 4052 wrote to memory of 3636	4052	cmd.exe	102
PID 4052 wrote to memory of 3636	4052	cmd.exe	102
PID 4052 wrote to memory of 3636	4052	cmd.exe	102
PID 4588 wrote to memory of 4724	4588	cmd.exe	101
PID 4588 wrote to memory of 4724	4588	cmd.exe	101
PID 4588 wrote to memory of 4724	4588	cmd.exe	101
PID 1256 wrote to memory of 496	1256	cmd.exe	103
PID 1256 wrote to memory of 496	1256	cmd.exe	103
PID 1256 wrote to memory of 496	1256	cmd.exe	103
PID 1632 wrote to memory of 3520	1632	cmd.exe	104
PID 1632 wrote to memory of 3520	1632	cmd.exe	104
PID 1632 wrote to memory of 3520	1632	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702.exe
"C:\Users\Admin\AppData\Local\Temp\adbd1d712011e4e4bbe657b2af1186dd5441479f2bc9d63687b08c502b968702.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240604390.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftUpdater" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe" /f
    3⤵
    - Adds Run key to start application
    PID:3540
- C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe
  "C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe
    "C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:3636
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:4724
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1632
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:3520
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1256
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:496
- - C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe
    "C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240604390.bat

Filesize
158B

MD5
7aa3aa567eb861073716561cd4b7d5bb

SHA1
f23c8c13af5f26da9fe8aea5075632284a988738

SHA256
bd374172aa476371b8bb8e6b8d7ceb57480394ea479308e49b766a63804045a3

SHA512
5a76c69d35be8c9d3e2d4c38d40ad28431cf58953182175b81feb28dac40c75b09a23a17d854450d4b47b44bcf1e2a9e7847d14370a8a47d899c11f20e9ea73f

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe

Filesize
291KB

MD5
03479440fdb2ed24071507f29d6ba6fe

SHA1
625bdf44b0391193214c2a4af8c6596078b5f449

SHA256
93b7272d9e5ebbbb051b0089b0f0a95b5ffb9869b40af3ae5c3acc807c785c14

SHA512
b8b3c6bfaec3b67aeb0189f927acdc96d8fe387d4061e03218da60e3339e057902522dd3bed726d93400ce17a8a73c4b01492b024ff84c136710800f81bca105

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe

Filesize
291KB

MD5
03479440fdb2ed24071507f29d6ba6fe

SHA1
625bdf44b0391193214c2a4af8c6596078b5f449

SHA256
93b7272d9e5ebbbb051b0089b0f0a95b5ffb9869b40af3ae5c3acc807c785c14

SHA512
b8b3c6bfaec3b67aeb0189f927acdc96d8fe387d4061e03218da60e3339e057902522dd3bed726d93400ce17a8a73c4b01492b024ff84c136710800f81bca105

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe

Filesize
291KB

MD5
03479440fdb2ed24071507f29d6ba6fe

SHA1
625bdf44b0391193214c2a4af8c6596078b5f449

SHA256
93b7272d9e5ebbbb051b0089b0f0a95b5ffb9869b40af3ae5c3acc807c785c14

SHA512
b8b3c6bfaec3b67aeb0189f927acdc96d8fe387d4061e03218da60e3339e057902522dd3bed726d93400ce17a8a73c4b01492b024ff84c136710800f81bca105

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsUpdater\svchost.exe

Filesize
291KB

MD5
03479440fdb2ed24071507f29d6ba6fe

SHA1
625bdf44b0391193214c2a4af8c6596078b5f449

SHA256
93b7272d9e5ebbbb051b0089b0f0a95b5ffb9869b40af3ae5c3acc807c785c14

SHA512
b8b3c6bfaec3b67aeb0189f927acdc96d8fe387d4061e03218da60e3339e057902522dd3bed726d93400ce17a8a73c4b01492b024ff84c136710800f81bca105

Download Submit
memory/176-157-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/176-169-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/176-159-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/176-152-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4356-148-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4356-175-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4356-156-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4356-153-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4356-170-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4624-132-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/4624-144-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/4624-135-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/4824-162-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/4824-146-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/4824-145-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads