022e498fe973889e1c2ad0964f0a097a87feb14ceb314a5c19c7ff5d9c7ebb36

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tweaks/1.bat
Size 253B
Sample240528-mexmlage85
SHA256 9ee833b3b341ab2fbbc1b215c2613a3cb947aa5174122f69c87068c54d3b6f8a
MD5 ce17bbdf67566edb48a72c10dc53aa19
SHA1 5463f627871b844a098871aa5dbe43ef9f39d09e
SHA512 6c76ccb6b1bf9c40c62c50ab04fe053f7358496eafa0345f14dc0a5f2e29cf58a3f87e301efe876ba9d2ac9f3ca5471d7af991d3f4c7097fd1f55dc9976360da
MD5 SHA1 SHA512

Score

10^/10

discovery evasion exploit ransomware trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	reg.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2236	bcdedit.exe
2128	bcdedit.exe
3668	bcdedit.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
3736	takeown.exe
4880	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3736	takeown.exe
4880	icacls.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallPaper	reg.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3392	powercfg.exe
Token: SeCreatePagefilePrivilege	3392	powercfg.exe
Token: SeShutdownPrivilege	3392	powercfg.exe
Token: SeCreatePagefilePrivilege	3392	powercfg.exe
Token: SeTakeOwnershipPrivilege	3736	takeown.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2236	2240	cmd.exe	91
PID 2240 wrote to memory of 2236	2240	cmd.exe	91
PID 2240 wrote to memory of 2128	2240	cmd.exe	92
PID 2240 wrote to memory of 2128	2240	cmd.exe	92
PID 2240 wrote to memory of 3668	2240	cmd.exe	93
PID 2240 wrote to memory of 3668	2240	cmd.exe	93
PID 2240 wrote to memory of 3392	2240	cmd.exe	94
PID 2240 wrote to memory of 3392	2240	cmd.exe	94
PID 2240 wrote to memory of 3264	2240	cmd.exe	95
PID 2240 wrote to memory of 3264	2240	cmd.exe	95
PID 2240 wrote to memory of 3736	2240	cmd.exe	96
PID 2240 wrote to memory of 3736	2240	cmd.exe	96
PID 2240 wrote to memory of 4880	2240	cmd.exe	97
PID 2240 wrote to memory of 4880	2240	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tweaks\1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootuxdisabled yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2236
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2128
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3668
- C:\Windows\system32\powercfg.exe
  powercfg h off
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- C:\Windows\system32\reg.exe
  reg import 1.reg
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Sets desktop wallpaper using registry
  PID:3264
- C:\Windows\system32\takeown.exe
  takeown /F C:\Windows\System32\dbgeng.dll
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3736
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\System32\dbgeng.dll /grant Administrators:D
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2864 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:1648