Analysis
- max time kernel
16s - max time network
28s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
06/11/2024, 23:43
Behavioral task
behavioral1
Sample
Asmodeus.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Asmodeus.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target Asmodeus.exe
- Size 1.2MB
- Sample241106-3ql81asphl
- SHA256 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
- MD5 e0340f456f76993fc047bc715dfdae6a
- SHA1 d47f6f7e553c4bc44a2fe88c2054de901390b2d7
- SHA512 cac10c675d81630eefca49b2ac4cc83f3eb29115ee28a560db4d6c33f70bf24980e48bb48ce20375349736e3e6b23a1ca504b9367917328853fffc5539626bbc
- SSDEEP 24576:/4GHnhIzOasqUgEOr69/BRH7dCibu+XoAX0eOTva49ttrSpt81ekHPyWe:AshdasJgEOrGBRxCihH7OO49rveMG
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (130) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 3 IoCs
pid Process 3244 protect.exe 4884 assembler.exe 4996 overwrite.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 overwrite.exe - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023c95-22.dat autoit_exe behavioral2/memory/4720-170-0x0000000000680000-0x000000000090E000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/4720-0-0x0000000000680000-0x000000000090E000-memory.dmp upx behavioral2/memory/4720-170-0x0000000000680000-0x000000000090E000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assembler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language overwrite.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Asmodeus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language protect.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "5" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe 3244 protect.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4720 Asmodeus.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 4720 Asmodeus.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4812 LogonUI.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4720 wrote to memory of 3244 4720 Asmodeus.exe 87 PID 4720 wrote to memory of 3244 4720 Asmodeus.exe 87 PID 4720 wrote to memory of 3244 4720 Asmodeus.exe 87 PID 4720 wrote to memory of 4884 4720 Asmodeus.exe 88 PID 4720 wrote to memory of 4884 4720 Asmodeus.exe 88 PID 4720 wrote to memory of 4884 4720 Asmodeus.exe 88 PID 4720 wrote to memory of 4996 4720 Asmodeus.exe 90 PID 4720 wrote to memory of 4996 4720 Asmodeus.exe 90 PID 4720 wrote to memory of 4996 4720 Asmodeus.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Asmodeus.exe"C:\Users\Admin\AppData\Local\Temp\Asmodeus.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\70375873\protect.exe"C:\Users\Admin\70375873\protect.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3244
-
-
C:\Users\Admin\70375873\assembler.exe"C:\Users\Admin\70375873\assembler.exe" -f bin "C:\Users\Admin\70375873\boot.asm" -o "C:\Users\Admin\70375873\boot.bin"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4884
-
-
C:\Users\Admin\70375873\overwrite.exe"C:\Users\Admin\70375873\overwrite.exe" "C:\Users\Admin\70375873\boot.bin"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:4996
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ad855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\70375873\assembler.exe
- Size 589KB
- SHA256 2a5305369edb9c2d7354b2f210e91129e4b8c546b0adf883951ea7bf7ee0f2b2
- MD5 7e3cea1f686207563c8369f64ea28e5b
- SHA1 a1736fd61555841396b0406d5c9ca55c4b6cdf41
- SHA512 4629bc32094bdb030e6c9be247068e7295599203284cb95921c98fcbe3ac60286670be7e5ee9f0374a4017286c7af9db211bd831e3ea871d31a509d7bbc1d6a3
- SSDEEP 12288:C9+m3cibQpBFu0ZMY7Ox1x0RzoyE/xd7I6Ixq8wd8JS:C9+m3cibQrE38UoS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\70375873\boot.asm
- Size 825B
- SHA256 91e74c438099172b057bedf693d877bd08677d5f2173763986be4974c0970581
- MD5 def1219cfb1c0a899e5c4ea32fe29f70
- SHA1 88aedde59832576480dfc7cd3ee6f54a132588a8
- SHA512 1e735d588cb1bb42324eaff1b9190ec6a8254f419d1ba4a13d03716ff5c102a335532b573a5befb08da90586e5670617066564ef9872f8c415b9a480836df423
- MD5 SHA1 SHA512
- Path C:\Users\Admin\70375873\boot.bin
- Size 512B
- SHA256 a760d8bc77ad8c0c839d4ef162ce44d5897af6fa84e0cc05ecc0747759ea76c2
- MD5 90053233e561c8bf7a7b14eda0fa0e84
- SHA1 16a7138387f7a3366b7da350c598f71de3e1cde2
- SHA512 63fda509cd02fd9d1374435f95515bc74f1ca8a9650b87d2299f8eee3a1c5a41b1cb8a4e1360c75f876f1dae193fdf4a96eba244683308f34d64d7ce37af2bb4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\70375873\overwrite.exe
- Size 288KB
- SHA256 f2bc5886b0f189976a367a69da8745bf66842f9bba89f8d208790db3dad0c7d2
- MD5 bc160318a6e8dadb664408fb539cd04b
- SHA1 4b5eb324eebe3f84e623179a8e2c3743ccf32763
- SHA512 51bc090f2821c57d94cfe4399b1f372a68d2811ea0b87d1ac1d6cf8ae39b167038ac21c471b168f1d19c6b213762024abb7e9e5ca311b246b46af0888289e46c
- SSDEEP 6144:h6r+IrezXLUgqspn73GDwG/K6786TEnCAIpi9MxipEl7BuHBTpOdNPIGAZTBO9NS:hSlUXoKOlzGt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\70375873\protect.exe
- Size 837KB
- SHA256 e61a8382f7293e40cb993ddcbcaa53a4e5f07a3d6b6a1bfe5377a1a74a8dcac6
- MD5 fd414666a5b2122c3d9e3e380cf225ed
- SHA1 de139747b42a807efa8a2dcc1a8304f9a29b862d
- SHA512 9ab2163d7deff29c202ed88dba36d5b28f6c67e647a0cadb3d03cc725796e19e5f298c04b1c8523d1d1ee4307e1a5d6f8156fa4021627d6ca1bbd0830695ae05
- SSDEEP 12288:5CdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBga87YAQ:5Cdxte/80jYLT3U1jfsWaEYAQ
- MD5 SHA1 SHA512 SSDEEP