Overview

overview

8

Static

static

ff1a48aaa4...f9.exe

windows7_x64

8

ff1a48aaa4...f9.exe

windows10_x64

8

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    11-05-2021 12:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe

  • Size

    2.6MB

  • MD5

    87d3d3a927c330c16c4b628a501409df

  • SHA1

    39e79273a41f84d068bb56052e575341ee166cae

  • SHA256

    ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9

  • SHA512

    0f260e8304bd784acfc628f95d667fda4a335e96e169d5974ed2b136dc804d45b86321dbf1ee6f7059258a044618576dc91a2a1d9d76441e814b462d486d40ea

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe
    "C:\Users\Admin\AppData\Local\Temp\ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      PID:1252
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 1444
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4800
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:1560
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1364
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:3984
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3076
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4172
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4540
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe
    MD5

    f65d4cf706c2add18897c640b67c8b84

    SHA1

    dd63c38d5fd4a2d466a36dc35e8c082237de24f8

    SHA256

    f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655

    SHA512

    b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6

    Download Submit
  • C:\ProgramData\Synaptics\Synaptics.exe
    MD5

    f65d4cf706c2add18897c640b67c8b84

    SHA1

    dd63c38d5fd4a2d466a36dc35e8c082237de24f8

    SHA256

    f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655

    SHA512

    b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe
    MD5

    e89d858f8b9cf41e090c446513a79138

    SHA1

    ee899c233da667985eb6dcc3023d7d80e7384687

    SHA256

    b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282

    SHA512

    dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\._cache_ff1a48aaa4ca00d40d6888713626e4aa42f36fd3806b368810708a60160f56f9.exe
    MD5

    e89d858f8b9cf41e090c446513a79138

    SHA1

    ee899c233da667985eb6dcc3023d7d80e7384687

    SHA256

    b908c4c07042d2b4045ce0c67a32a7025a7b851567dfcf84e4b53adfb66cf282

    SHA512

    dc0efd00b9f113068ecf1fe07e62dfff052c24430681e6b4f63e56456e191f4b882e4d6a843ce14aa0b7405d5cb830c8fb27dd52613e3610cb417472fbc3aed5

    Download Submit
  • memory/1252-115-0x0000000000000000-mapping.dmp
    Download
  • memory/1252-121-0x0000000002350000-0x000000000245D000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/1560-118-0x0000000000000000-mapping.dmp
    Download
  • memory/1560-122-0x00000000005D0000-0x00000000005D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3380-114-0x0000000000950000-0x0000000000951000-memory.dmp
    Filesize

    4KB

    Download