1068cb29f89d81ad0348c72c63a90588f35b9a520e57764daeed44dc22192c1a

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2023, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6hDkZtFd2S.exe
Size

1.1MB
MD5

21377e758f4ee739965642b393f13fe8
SHA1

edbfaed7cac6642cce909d18f8ee07aec722d874
SHA256

1068cb29f89d81ad0348c72c63a90588f35b9a520e57764daeed44dc22192c1a
SHA512

39f55734563fdbae2600f53bf07a68c450e76668517b25332d4f7672fc7e0409514cba19fe9fa2f01a140fb8973a95467b64e5e4b3d05400efdc8bf64a363d67
SSDEEP

12288:3bq7bcal64fG2Ms7cfl9/C8JAP2f3wBt6UQEM7ef7OB8GFX0w2WbmjoaTRgkSlTF:+fKWM82faZ4gJSGCiNOyjgT7PVf

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	6hDkZtFd2S.exe

Executes dropped EXE 1 IoCs

pid	Process
4012	svchost.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	6hDkZtFd2S.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3932	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5040	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4748	6hDkZtFd2S.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe
4012	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4012	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	6hDkZtFd2S.exe
Token: SeDebugPrivilege	4012	svchost.exe
Token: SeDebugPrivilege	4012	svchost.exe
Token: SeLoadDriverPrivilege	4012	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1808	4748	6hDkZtFd2S.exe	85
PID 4748 wrote to memory of 1808	4748	6hDkZtFd2S.exe	85
PID 4748 wrote to memory of 380	4748	6hDkZtFd2S.exe	87
PID 4748 wrote to memory of 380	4748	6hDkZtFd2S.exe	87
PID 380 wrote to memory of 5040	380	cmd.exe	89
PID 380 wrote to memory of 5040	380	cmd.exe	89
PID 1808 wrote to memory of 3932	1808	cmd.exe	90
PID 1808 wrote to memory of 3932	1808	cmd.exe	90
PID 380 wrote to memory of 4012	380	cmd.exe	91
PID 380 wrote to memory of 4012	380	cmd.exe	91
PID 4012 wrote to memory of 2220	4012	svchost.exe	95
PID 4012 wrote to memory of 2220	4012	svchost.exe	95
PID 4012 wrote to memory of 3604	4012	svchost.exe	96
PID 4012 wrote to memory of 3604	4012	svchost.exe	96
PID 4012 wrote to memory of 2868	4012	svchost.exe	97
PID 4012 wrote to memory of 2868	4012	svchost.exe	97
PID 4012 wrote to memory of 3224	4012	svchost.exe	100
PID 4012 wrote to memory of 3224	4012	svchost.exe	100
PID 4012 wrote to memory of 5108	4012	svchost.exe	98
PID 4012 wrote to memory of 5108	4012	svchost.exe	98
PID 4012 wrote to memory of 1444	4012	svchost.exe	99
PID 4012 wrote to memory of 1444	4012	svchost.exe	99
PID 4012 wrote to memory of 1840	4012	svchost.exe	101
PID 4012 wrote to memory of 1840	4012	svchost.exe	101
PID 4012 wrote to memory of 4752	4012	svchost.exe	102
PID 4012 wrote to memory of 4752	4012	svchost.exe	102
PID 4012 wrote to memory of 2232	4012	svchost.exe	103
PID 4012 wrote to memory of 2232	4012	svchost.exe	103
PID 4012 wrote to memory of 4104	4012	svchost.exe	104
PID 4012 wrote to memory of 4104	4012	svchost.exe	104
PID 4012 wrote to memory of 1576	4012	svchost.exe	105
PID 4012 wrote to memory of 1576	4012	svchost.exe	105
PID 4012 wrote to memory of 4828	4012	svchost.exe	106
PID 4012 wrote to memory of 4828	4012	svchost.exe	106
PID 4012 wrote to memory of 2388	4012	svchost.exe	107
PID 4012 wrote to memory of 2388	4012	svchost.exe	107
PID 4012 wrote to memory of 2652	4012	svchost.exe	108
PID 4012 wrote to memory of 2652	4012	svchost.exe	108
PID 4012 wrote to memory of 4452	4012	svchost.exe	109
PID 4012 wrote to memory of 4452	4012	svchost.exe	109
PID 4012 wrote to memory of 4280	4012	svchost.exe	110
PID 4012 wrote to memory of 4280	4012	svchost.exe	110
PID 4012 wrote to memory of 3724	4012	svchost.exe	111
PID 4012 wrote to memory of 3724	4012	svchost.exe	111
PID 4012 wrote to memory of 3868	4012	svchost.exe	112
PID 4012 wrote to memory of 3868	4012	svchost.exe	112
PID 4012 wrote to memory of 3868	4012	svchost.exe	112
PID 4012 wrote to memory of 3920	4012	svchost.exe	113
PID 4012 wrote to memory of 3920	4012	svchost.exe	113
PID 4012 wrote to memory of 2208	4012	svchost.exe	114
PID 4012 wrote to memory of 2208	4012	svchost.exe	114
PID 4012 wrote to memory of 1500	4012	svchost.exe	115
PID 4012 wrote to memory of 1500	4012	svchost.exe	115
PID 4012 wrote to memory of 1500	4012	svchost.exe	115
PID 4012 wrote to memory of 932	4012	svchost.exe	116
PID 4012 wrote to memory of 932	4012	svchost.exe	116
PID 4012 wrote to memory of 2964	4012	svchost.exe	117
PID 4012 wrote to memory of 2964	4012	svchost.exe	117
PID 4012 wrote to memory of 5064	4012	svchost.exe	118
PID 4012 wrote to memory of 5064	4012	svchost.exe	118
PID 4012 wrote to memory of 3976	4012	svchost.exe	119
PID 4012 wrote to memory of 3976	4012	svchost.exe	119
PID 4012 wrote to memory of 5072	4012	svchost.exe	120
PID 4012 wrote to memory of 5072	4012	svchost.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6hDkZtFd2S.exe
"C:\Users\Admin\AppData\Local\Temp\6hDkZtFd2S.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA3C6.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:5040
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
      4⤵
      PID:2220
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
      4⤵
      PID:3604
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
      4⤵
      PID:2868
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
      4⤵
      PID:5108
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
      4⤵
      PID:1444
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
      4⤵
      PID:3224
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
      4⤵
      PID:1840
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
      4⤵
      PID:4752
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
      4⤵
      PID:2232
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4104
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:1576
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
      4⤵
      PID:4828
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:2388
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
      4⤵
      PID:2652
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
      4⤵
      PID:4452
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:4280
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:3724
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
      4⤵
      PID:3868
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3920
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
      4⤵
      PID:2208
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
      4⤵
      PID:1500
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
      4⤵
      PID:932
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:2964
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
      4⤵
      PID:5064
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3976
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
      4⤵
      PID:5072
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
      4⤵
      PID:2996
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
      4⤵
      PID:4444
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
      4⤵
      PID:3188
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
      4⤵
      PID:2616
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
      4⤵
      PID:4148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA3C6.tmp.bat

Filesize
151B

MD5
ffcf9bd2c364549482fc607691c0c096

SHA1
cbb144ca02ee1dfc95f34d6059e567e63e55b308

SHA256
e55b2922286b8697ab4005ddda31b73e0a56a33315f16a25076be2ed666101b6

SHA512
c8722ac11de3fbbb29ba099f605936308d73fac3627fff6df6f98dca57c4fa50510f21ca7e00ab390eed6203cdb63ceb3ebc8321cef428aa382eeaae49f85012

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
1.1MB

MD5
21377e758f4ee739965642b393f13fe8

SHA1
edbfaed7cac6642cce909d18f8ee07aec722d874

SHA256
1068cb29f89d81ad0348c72c63a90588f35b9a520e57764daeed44dc22192c1a

SHA512
39f55734563fdbae2600f53bf07a68c450e76668517b25332d4f7672fc7e0409514cba19fe9fa2f01a140fb8973a95467b64e5e4b3d05400efdc8bf64a363d67

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
1.1MB

MD5
21377e758f4ee739965642b393f13fe8

SHA1
edbfaed7cac6642cce909d18f8ee07aec722d874

SHA256
1068cb29f89d81ad0348c72c63a90588f35b9a520e57764daeed44dc22192c1a

SHA512
39f55734563fdbae2600f53bf07a68c450e76668517b25332d4f7672fc7e0409514cba19fe9fa2f01a140fb8973a95467b64e5e4b3d05400efdc8bf64a363d67

Download Submit
memory/4748-133-0x0000026842220000-0x0000026842346000-memory.dmp

Filesize
1.1MB

Download
memory/4748-134-0x000002685D3C0000-0x000002685D3D0000-memory.dmp

Filesize
64KB

Download