Analysis
- max time kernel
91s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 18:41
Behavioral task
behavioral1
Sample
RocerFace.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
RocerFace.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target RocerFace.exe
- Size 37KB
- Sample240602-xby2cscb33
- SHA256 9bf2adfac4d6853b2f268838402ce059008dbad101f5311d2d6ef182130dee72
- MD5 7b5820afc26cb44f4a84c3c4b7bbc529
- SHA1 3ef311e4005db7f2a88711c30c5ab93349f9253e
- SHA512 4bd2cea04cf093a8088aafc598faeb84928d1f41f9a9c0d130b2651d4af56c017275ffb66366b0f04cebd4d1f64e5419eddc348b743155f090cecc3ee3077812
- SSDEEP 384:cSu1HCiMT3jBVbJsy8PVAbAoJvzv7QyYdSrAF+rMRTyN/0L+EcoinblneHQM3epC:5hbJP8PVsAafVY0rM+rMRa8NuwZt
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 832 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation RocerFace.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b5206f5f64d54322966257a3e6bb4abc.exe WIndows services.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b5206f5f64d54322966257a3e6bb4abc.exe WIndows services.exe - Executes dropped EXE 1 IoCs
pid Process 4548 WIndows services.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b5206f5f64d54322966257a3e6bb4abc = "\"C:\\Windows\\WIndows services.exe\" .." WIndows services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b5206f5f64d54322966257a3e6bb4abc = "\"C:\\Windows\\WIndows services.exe\" .." WIndows services.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 43 0.tcp.eu.ngrok.io - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\WIndows services.exe RocerFace.exe File opened for modification C:\Windows\WIndows services.exe RocerFace.exe File opened for modification C:\Windows\WIndows services.exe WIndows services.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "221" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe 4548 WIndows services.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4548 WIndows services.exe - Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 4548 WIndows services.exe Token: 33 4548 WIndows services.exe Token: SeIncBasePriorityPrivilege 4548 WIndows services.exe Token: 33 4548 WIndows services.exe Token: SeIncBasePriorityPrivilege 4548 WIndows services.exe Token: 33 4548 WIndows services.exe Token: SeIncBasePriorityPrivilege 4548 WIndows services.exe Token: 33 4548 WIndows services.exe Token: SeIncBasePriorityPrivilege 4548 WIndows services.exe Token: 33 4548 WIndows services.exe Token: SeIncBasePriorityPrivilege 4548 WIndows services.exe Token: 33 4548 WIndows services.exe Token: SeIncBasePriorityPrivilege 4548 WIndows services.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4000 LogonUI.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4188 wrote to memory of 4548 4188 RocerFace.exe 94 PID 4188 wrote to memory of 4548 4188 RocerFace.exe 94 PID 4188 wrote to memory of 4548 4188 RocerFace.exe 94 PID 4548 wrote to memory of 832 4548 WIndows services.exe 99 PID 4548 wrote to memory of 832 4548 WIndows services.exe 99 PID 4548 wrote to memory of 832 4548 WIndows services.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\RocerFace.exe"C:\Users\Admin\AppData\Local\Temp\RocerFace.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\WIndows services.exe"C:\Windows\WIndows services.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\WIndows services.exe" "WIndows services.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:832
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:440
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa398d055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4000
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WIndows services.exe
- Size 37KB
- SHA256 9bf2adfac4d6853b2f268838402ce059008dbad101f5311d2d6ef182130dee72
- MD5 7b5820afc26cb44f4a84c3c4b7bbc529
- SHA1 3ef311e4005db7f2a88711c30c5ab93349f9253e
- SHA512 4bd2cea04cf093a8088aafc598faeb84928d1f41f9a9c0d130b2651d4af56c017275ffb66366b0f04cebd4d1f64e5419eddc348b743155f090cecc3ee3077812
- SSDEEP 384:cSu1HCiMT3jBVbJsy8PVAbAoJvzv7QyYdSrAF+rMRTyN/0L+EcoinblneHQM3epC:5hbJP8PVsAafVY0rM+rMRa8NuwZt
- MD5 SHA1 SHA512 SSDEEP