1eefaeb98524277d1aeb459b6e4a31472ce2f4ff15f8f45b051e1c8a021c8fa7

Analysis

max time kernel
133s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Covid-666.exe
Size

687KB
MD5

0c303ae1347c0395a96f3eb38d26d7ed
SHA1

c8cf473a22fc86ddad00ec286e94422f4b7d5c59
SHA256

1eefaeb98524277d1aeb459b6e4a31472ce2f4ff15f8f45b051e1c8a021c8fa7
SHA512

57e9ca4e5339164a6c3e5f53b8f30410d86139355390e17a2926d5b2263a511f0d47b26f70e95a5cf8daf4c365fec7f057614636e6f092d8320fcdda8debea93
SSDEEP

12288:U7M23cFQpIn5tghlAjyCey1vLd31utolsqHzc30qOocuXi7oS:Ug2sq2nohlAtrvLjutQtI3bOoli

Score

8^/10

bootkit evasion persistence ransomware upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	Covid-666.exe

Executes dropped EXE 2 IoCs

pid	Process
4028	mbr.exe
4440	MainWindow.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1548-0-0x0000000000400000-0x000000000064F000-memory.dmp	upx
behavioral2/memory/1548-25-0x0000000000400000-0x000000000064F000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	mbr.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "c:\\note.bmp"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "c:\\note.bmp"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
4324	reg.exe
2184	reg.exe
4808	reg.exe
3500	reg.exe
5004	reg.exe
3116	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4032	shutdown.exe
Token: SeRemoteShutdownPrivilege	4032	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4440	MainWindow.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 368	1548	Covid-666.exe	84
PID 1548 wrote to memory of 368	1548	Covid-666.exe	84
PID 1548 wrote to memory of 368	1548	Covid-666.exe	84
PID 368 wrote to memory of 3116	368	cmd.exe	88
PID 368 wrote to memory of 3116	368	cmd.exe	88
PID 368 wrote to memory of 3116	368	cmd.exe	88
PID 368 wrote to memory of 4324	368	cmd.exe	90
PID 368 wrote to memory of 4324	368	cmd.exe	90
PID 368 wrote to memory of 4324	368	cmd.exe	90
PID 368 wrote to memory of 2184	368	cmd.exe	91
PID 368 wrote to memory of 2184	368	cmd.exe	91
PID 368 wrote to memory of 2184	368	cmd.exe	91
PID 368 wrote to memory of 4808	368	cmd.exe	92
PID 368 wrote to memory of 4808	368	cmd.exe	92
PID 368 wrote to memory of 4808	368	cmd.exe	92
PID 368 wrote to memory of 3500	368	cmd.exe	93
PID 368 wrote to memory of 3500	368	cmd.exe	93
PID 368 wrote to memory of 3500	368	cmd.exe	93
PID 368 wrote to memory of 4028	368	cmd.exe	94
PID 368 wrote to memory of 4028	368	cmd.exe	94
PID 368 wrote to memory of 4028	368	cmd.exe	94
PID 368 wrote to memory of 1508	368	cmd.exe	95
PID 368 wrote to memory of 1508	368	cmd.exe	95
PID 368 wrote to memory of 1508	368	cmd.exe	95
PID 368 wrote to memory of 2840	368	cmd.exe	97
PID 368 wrote to memory of 2840	368	cmd.exe	97
PID 368 wrote to memory of 2840	368	cmd.exe	97
PID 368 wrote to memory of 3436	368	cmd.exe	98
PID 368 wrote to memory of 3436	368	cmd.exe	98
PID 368 wrote to memory of 3436	368	cmd.exe	98
PID 368 wrote to memory of 4540	368	cmd.exe	99
PID 368 wrote to memory of 4540	368	cmd.exe	99
PID 368 wrote to memory of 4540	368	cmd.exe	99
PID 368 wrote to memory of 2104	368	cmd.exe	100
PID 368 wrote to memory of 2104	368	cmd.exe	100
PID 368 wrote to memory of 2104	368	cmd.exe	100
PID 368 wrote to memory of 5004	368	cmd.exe	101
PID 368 wrote to memory of 5004	368	cmd.exe	101
PID 368 wrote to memory of 5004	368	cmd.exe	101
PID 368 wrote to memory of 4440	368	cmd.exe	102
PID 368 wrote to memory of 4440	368	cmd.exe	102
PID 368 wrote to memory of 4440	368	cmd.exe	102
PID 368 wrote to memory of 4032	368	cmd.exe	103
PID 368 wrote to memory of 4032	368	cmd.exe	103
PID 368 wrote to memory of 4032	368	cmd.exe	103
PID 368 wrote to memory of 2956	368	cmd.exe	105
PID 368 wrote to memory of 2956	368	cmd.exe	105
PID 368 wrote to memory of 2956	368	cmd.exe	105
PID 368 wrote to memory of 3140	368	cmd.exe	106
PID 368 wrote to memory of 3140	368	cmd.exe	106
PID 368 wrote to memory of 3140	368	cmd.exe	106
PID 368 wrote to memory of 4880	368	cmd.exe	107
PID 368 wrote to memory of 4880	368	cmd.exe	107
PID 368 wrote to memory of 4880	368	cmd.exe	107
PID 368 wrote to memory of 408	368	cmd.exe	108
PID 368 wrote to memory of 408	368	cmd.exe	108
PID 368 wrote to memory of 408	368	cmd.exe	108
PID 368 wrote to memory of 680	368	cmd.exe	109
PID 368 wrote to memory of 680	368	cmd.exe	109
PID 368 wrote to memory of 680	368	cmd.exe	109
PID 368 wrote to memory of 616	368	cmd.exe	110
PID 368 wrote to memory of 616	368	cmd.exe	110
PID 368 wrote to memory of 616	368	cmd.exe	110
PID 368 wrote to memory of 2800	368	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\Covid-666.exe
"C:\Users\Admin\AppData\Local\Temp\Covid-666.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\732C.tmp\Covid666.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3116
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4324
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2184
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4808
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3500
- - C:\Users\Admin\AppData\Local\Temp\732C.tmp\mbr.exe
    mbr.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:4028
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\note.bmp /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:1508
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3436
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4540
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5004
- - C:\Users\Admin\AppData\Local\Temp\732C.tmp\MainWindow.exe
    MainWindow.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4440
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 240 /c "You have only 4 minutes to complete the payment or all your data is lost forever"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\note.bmp /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:2956
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:408
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:680
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:616
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:956
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\732C.tmp\Covid666.bat

Filesize
1KB

MD5
5e19b2eeb24514e87aa6039bd012fa6e

SHA1
4f8ad456f7050a8fa572043dc42a0ae5bd0dc6a5

SHA256
0cabbe47e3a8799502084b4c691634d16dc3bf317fc17d9d898ed336a476c778

SHA512
8c9faabd001af53f081c2fe38bd3c930de8c4aa1813afb66b106ffbdd796040b1dcc11ddccf965edf100283f38e587d4d937cbb4455379317ce5a5b59b7c8cc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\732C.tmp\MainWindow.exe

Filesize
20KB

MD5
23ab00deb47223ba73b700eb371fb0fe

SHA1
ba2e077c3790bdae4083fe9283f38a13efdcc4b1

SHA256
d42807867bd69d5db2605e4e6f39e5f70e0cc9db0cac9216fd6a9cd8cc324e0d

SHA512
d37252a1620f532230160f16c5d87fc79928842c0af41805c1fed1115ef0cfca6767d48c5d9ce6c6a4b042cd152cd1a2f9b49ad9380b08980680b26c5a4805c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\732C.tmp\mbr.exe

Filesize
1.3MB

MD5
2b1aa2297f9f2d08bc1447213ef869a9

SHA1
198802a4d09f9b4f7d2514575c3b9d35afca6833

SHA256
c9c6b0edd58fc2e85c44774c457a6c03c05253e1dbca91645b2c4ba1449e0f11

SHA512
7affd52dc3287d33c8587f63764593496d179d5595a55ba96a4d8ded8b2730465f0447d9ca7e07cb62c48f4097a1fbb554a90d0566b0b7e6227cc535ad467b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\732C.tmp\note.bmp

Filesize
806KB

MD5
4a43a8b397043b6eb9c5359cf45da6f8

SHA1
d672f59eef6ec2d82b925b74608b6ecea8f16db8

SHA256
3aabd4300d36cac3e85dee2274351b0e58c2f19b59b607751127f5ae0c2bc8a1

SHA512
f77290245703c8790c9e1709f91991437601847d3c4afef34f03032b7d754016f5fc569ff4ce5f6f224a6b60a27d2853519b77170f6f5366221170fb4523f201

Download Submit
memory/1548-0-0x0000000000400000-0x000000000064F000-memory.dmp

Filesize
2.3MB

Download
memory/1548-25-0x0000000000400000-0x000000000064F000-memory.dmp

Filesize
2.3MB

Download
memory/4028-19-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads