Overview

overview

10

Static

static

10

rel/X_ATTA....9.exe

windows10-ltsc 2021-x64

10

rel/data/Cloner.py

windows10-ltsc 2021-x64

3

rel/data/Main.bat

windows10-ltsc 2021-x64

8

rel/data/Xprocess.exe

windows10-ltsc 2021-x64

7

rel/data/boot.bat

windows10-ltsc 2021-x64

1

rel/data/bootdis.exe

windows10-ltsc 2021-x64

7

rel/data/copy.bat

windows10-ltsc 2021-x64

7

rel/data/c...py.exe

windows10-ltsc 2021-x64

7

rel/data/ddos.exe

windows10-ltsc 2021-x64

1

rel/data/emoji.py

windows10-ltsc 2021-x64

3

rel/data/fixpy.bat

windows10-ltsc 2021-x64

1

rel/data/i...on.bat

windows10-ltsc 2021-x64

8

rel/data/joiner.py

windows10-ltsc 2021-x64

3

rel/data/sms.exe

windows10-ltsc 2021-x64

10

rel/data/tc.py

windows10-ltsc 2021-x64

3

rel/data/wbspam.exe

windows10-ltsc 2021-x64

7

rel/fix.bat

windows10-ltsc 2021-x64

1

rel/token.bat

windows10-ltsc 2021-x64

7

rel/token2.bat

windows10-ltsc 2021-x64

7

Analysis

  • max time kernel
    255s
  • max time network
    274s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    18-12-2024 17:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    rel/data/install-python.bat

  • Size

    4KB

  • MD5

    05525205f01645c56a9429dac23e9901

  • SHA1

    b5e490ed908b263b9a89ef7305b4e20585f6aaa0

  • SHA256

    c3a0c979f4f3f3c2dca28ff6cd584c3a0af7c6e3026864b7013f76bcff084b99

  • SHA512

    4e66775e5caadd914d744330f5ea1ca65a7638b0e12f37bb8bbcf5410aa51c338edd9d8b13b2521e066b73075a896850abd2709b23e31d53f0051701fd1f45e2

  • SSDEEP

    96:Wy0OhxKWYpV8TCKzCpzTqd2L0VhZEjAoN2bj:Zf1K7L0aZc

Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 20 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • cURL User-Agent 5 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\rel\data\install-python.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\system32\curl.exe
      curl -L -O http://python.org/ftp/python/2.7.6/python-2.7.6.msi
      2⤵
        PID:712
      • C:\Windows\system32\msiexec.exe
        msiexec.exe /qb /i python-2.7.6.msi ALLUSERS=1 ADDLOCAL=ALL
        2⤵
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1672
      • C:\Windows\system32\reg.exe
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /f /v PATH /t REG_EXPAND_SZ /d "C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;;c:\Python27;c:\Python27\Scripts"
        2⤵
          PID:4332
        • C:\Windows\system32\reg.exe
          reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /f /v LOCALAPPDATA /t REG_SZ /d "c:\Python27\AppData"
          2⤵
            PID:1756
          • C:\Windows\system32\curl.exe
            curl -L -O "http://downloads.sourceforge.net/project/pywin32/pywin32/Build%20218/pywin32-218.win32-py2.7.exe"
            2⤵
              PID:4540
            • C:\Windows\system32\curl.exe
              curl -O https://bitbucket.org/pypa/setuptools/raw/bootstrap/ez_setup.py
              2⤵
                PID:5104
              • C:\Windows\system32\curl.exe
                curl -O https://raw.github.com/pypa/pip/master/contrib/get-pip.py
                2⤵
                  PID:3716
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo y"
                  2⤵
                    PID:1440
                  • C:\Windows\system32\cacls.exe
                    cacls c:\Python27\Lib\site-packages\*.* /T /E /G BUILTIN\Users:R
                    2⤵
                      PID:3088
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=4200,i,18033710974209630210,2205953364507939555,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
                    1⤵
                      PID:688
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                      • Blocklisted process makes network request
                      • Enumerates connected drives
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Modifies data under HKEY_USERS
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2104
                      • C:\Windows\system32\srtasks.exe
                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
                        2⤵
                          PID:728
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding 52BB664FA0FED88D3567BD434FF49FC2
                          2⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:4280
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3920
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=4252,i,18033710974209630210,2205953364507939555,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
                        1⤵
                          PID:3796

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\rel\data\python-2.7.6.msi
                          Filesize

                          15.5MB

                          MD5

                          ac54e14f7ba180253b9bae6635d822ea

                          SHA1

                          c5d71f339f7edd70ecd54b50e97356191347d355

                          SHA256

                          cfa801a6596206ec7476e9bc2687fcd331c514b3dd92ffc3cd7d63e749ba0b2f

                          SHA512

                          81d673386382e27a9a479972b28102ff183e7c07891ee9cb44b9df1325a15ec9963a4c52c329c447fa861874da78355cc7168acb836742e3b426970ac25704a3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\rel\data\pywin32-218.win32-py2.7.exe
                          Filesize

                          6.4MB

                          MD5

                          16e178ac18b49fa0d27ba0be90f460af

                          SHA1

                          af2e516431269806084694e0d48aff9438e2c263

                          SHA256

                          dd665cca88cb059fec960516ed5f29474b33fce50fcb2633d397d4a3aa705c16

                          SHA512

                          e12082f75ae3198625b48197f57efde4369e0f2aab3ba4d229617520002c336512b48bc2cc73c01f5b06e86c309e4e14c0f1ff99d0080abce4f6a6d798304958

                          Download Submit

                        • C:\Windows\Installer\MSIB418.tmp
                          Filesize

                          40KB

                          MD5

                          8a3e5fbee27198975884d25e5df7a69b

                          SHA1

                          8e389374594ecceeea547825a83cd397339acdcf

                          SHA256

                          9356b41a0129c4de9257c659a5c70fa2c66dcafadf5785b18eece45b792b5857

                          SHA512

                          4ea8570cef7fe45cb5b9c28f95819a7ee827a83888d3cbac2eda8e27d7bdb389fe6691af8dca8bce15529e7d14f056f404b0243c8bbd4d29b6f20eebe867d729

                          Download Submit

                        • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                          Filesize

                          23.9MB

                          MD5

                          685d6b5fd7affaa2ec27a84b853bd649

                          SHA1

                          b149e44f35375f6d70f36381b20d3de2678c5547

                          SHA256

                          dd50173dfc6bc6a0d8f1019107b87291eef659aa2180f700afd986de50eb81c3

                          SHA512

                          8f43a8defb7e555f6fe0b4e554f0cedfae17d6ec85d7f29184528cd9ab4bc50007eedd85e94020e953b2e08a4e2cdbad461d357b2d88f702945e88fd82da280c

                          Download Submit

                        • \??\Volume{0c5035a5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d886b6fc-205f-403f-bf89-b6dedff243ea}_OnDiskSnapshotProp
                          Filesize

                          6KB

                          MD5

                          8b620d56b2b9b8387d31cf58d781c83e

                          SHA1

                          b36f2753ad571e1ee83bc1a08ff6329520f90f01

                          SHA256

                          fe74ebe4019f15b5fc4862e5bce8e56d3d8003ec827215f9cefbb67eec9bc011

                          SHA512

                          7a813175b68f816d2c76caaa61b772d1cd02225b4ccba494982db520a4d9de9960552e6a8c1c25bb426b1ce6627a6bdf3c0ffde6091cb362ea7bc0e7a3816a2f

                          Download Submit