ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed

General

Target

ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
Size

123KB
MD5

c50a968d1c6351e9e087a56b1e5a1acd
SHA1

d9c4742a26bf41c5009f2e56f53ae9fab931a5b1
SHA256

ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed
SHA512

a98ff57f8246de2a0f9293559e5a4d34853a22bd0c85237d6662ecb81356c6466164e7f61345bbb1b31ed09ff61cb464732c5af8bb674601a3ebb6c703d009b7
SSDEEP

3072:wlrwbVaNHJLRnXsJynTQkQhYXzKexgUxTEe8ELcfffffffffU1:6sBaNp1synTQkQhYXzxSUBB9cffffffc

Score

9^/10

evasion persistence ransomware spyware stealer

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4376	bcdedit.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SearchFilterHost = "cmd /c \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe\" --zxcv"	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4296	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
3088	taskkill.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
Token: SeDebugPrivilege	3088	taskkill.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 3944	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	82
PID 1544 wrote to memory of 3944	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	82
PID 1544 wrote to memory of 3412	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	86
PID 1544 wrote to memory of 3412	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	86
PID 1544 wrote to memory of 3616	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	87
PID 1544 wrote to memory of 3616	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	87
PID 1544 wrote to memory of 1072	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	88
PID 1544 wrote to memory of 1072	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	88
PID 1544 wrote to memory of 4948	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	89
PID 1544 wrote to memory of 4948	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	89
PID 1544 wrote to memory of 4296	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	90
PID 1544 wrote to memory of 4296	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	90
PID 1544 wrote to memory of 4376	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	91
PID 1544 wrote to memory of 4376	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	91
PID 1544 wrote to memory of 3088	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	94
PID 1544 wrote to memory of 3088	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	94
PID 1544 wrote to memory of 5028	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	100
PID 1544 wrote to memory of 5028	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	100
PID 1544 wrote to memory of 3664	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	101
PID 1544 wrote to memory of 3664	1544	ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe	101

C:\Users\Admin\AppData\Local\Temp\ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe
"C:\Users\Admin\AppData\Local\Temp\ab142f5dba2c3dac90f8303c44e74970bb42792ae7ff480426b9c1893cacf9ed.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SYSTEM32\CMD.exe
  CMD /C RD %TEMP% /S/Q & MKDIR %TEMP%
  2⤵
  PID:3944
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:3412
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:3616
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:1072
- C:\Windows\SYSTEM32\CMD.exe
  CMD /C %WINDIR%\sysnative\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  PID:4948
- C:\Windows\SYSTEM32\sc.exe
  sc delete syshost32
  2⤵
  - Launches sc.exe
  PID:4296
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set TESTSIGNING OFF
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4376
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im msiexec.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" CMD /C DEL /F /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.* "
  2⤵
  PID:5028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" CMD /C DEL /F /S /Q "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*.* "
  2⤵
  PID:3664