Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
03/05/2024, 22:01
General
- Target 57dfe039d38261c96473c338d867ed0c1398d9c7219c5994ff78bea7354235ed.exe
- Size 333KB
- Sample240503-1w6hqaae35
- SHA256 57dfe039d38261c96473c338d867ed0c1398d9c7219c5994ff78bea7354235ed
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 9 IoCs
- Modifies security service 2 TTPs 4 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- UAC bypass 3 TTPs 6 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Detects executables containing artifacts associated with disabling Widnows Defender 2 IoCs
- Detects executables containing commands for clearing Windows Event Logs 2 IoCs
- Detects executables containing common artifacts observed in infostealers 2 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 2 IoCs
- Executes dropped EXE 1 IoCs
- Windows security modification 2 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
- System policy modification 1 TTPs 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\57dfe039d38261c96473c338d867ed0c1398d9c7219c5994ff78bea7354235ed.exe"C:\Users\Admin\AppData\Local\Temp\57dfe039d38261c96473c338d867ed0c1398d9c7219c5994ff78bea7354235ed.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "\Microsoft\Windows\System\v64\Files\AgentLogOfcase" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Local\Temp\57dfe039d38261c96473c338d867ed0c1398d9c7219c5994ff78bea7354235ed.exe" /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "AgentLogOfcase" /f2⤵
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\RiveLogsec\HSteces.exe"C:\Users\Admin\AppData\Roaming\RiveLogsec\HSteces.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "\Microsoft\Windows\System\v64\Files\AgentLogOfcase" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Roaming\RiveLogsec\HSteces.exe" /f3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "AgentLogOfcase" /f3⤵
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_xoxdrkiq.mwb.ps1
settings.xml
HSteces.exe
settings.xml
memory/1196-17-0x00000238DA080000-0x00000238DA0A2000-memory.dmp
memory/2964-0-0x00007FFDF4D53000-0x00007FFDF4D55000-memory.dmp
memory/2964-10-0x0000000002B70000-0x0000000002BAC000-memory.dmp
memory/2964-30-0x00007FFDF4D50000-0x00007FFDF5811000-memory.dmp
memory/2964-9-0x0000000002B00000-0x0000000002B12000-memory.dmp
memory/2964-2-0x00007FFDF4D50000-0x00007FFDF5811000-memory.dmp
memory/2964-1-0x0000000000990000-0x00000000009EA000-memory.dmp