33e776ea3003ef1d2c9383df7fd00e36de86ace90b2693798cbe0d49c2284b85

General

Target
3636dbafd9e7d2c9fbcf6925814785f4.exe
Size 504KB
Sample220119-ksrbmagedk
SHA256 33e776ea3003ef1d2c9383df7fd00e36de86ace90b2693798cbe0d49c2284b85
MD5 3636dbafd9e7d2c9fbcf6925814785f4
SHA1 d14d41089d58b394af1a3f954be315e1a8f4b2a0
SHA512 3fc48569c399c78f569f6cb36cc633b27aa582fa121fa7b6717039cfb4b91f973000c982f28ef24ba0dd6d20c9c3aa0b6ba08371116a48659b3f286898027e09
MD5 SHA1 SHA512

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	3636dbafd9e7d2c9fbcf6925814785f4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1848	3636dbafd9e7d2c9fbcf6925814785f4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	3636dbafd9e7d2c9fbcf6925814785f4.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 396	1848	3636dbafd9e7d2c9fbcf6925814785f4.exe	57
PID 1848 wrote to memory of 396	1848	3636dbafd9e7d2c9fbcf6925814785f4.exe	57
PID 1848 wrote to memory of 396	1848	3636dbafd9e7d2c9fbcf6925814785f4.exe	57
PID 1848 wrote to memory of 3956	1848	3636dbafd9e7d2c9fbcf6925814785f4.exe	59
PID 1848 wrote to memory of 3956	1848	3636dbafd9e7d2c9fbcf6925814785f4.exe	59
PID 1848 wrote to memory of 3956	1848	3636dbafd9e7d2c9fbcf6925814785f4.exe	59

C:\Users\Admin\AppData\Local\Temp\3636dbafd9e7d2c9fbcf6925814785f4.exe
"C:\Users\Admin\AppData\Local\Temp\3636dbafd9e7d2c9fbcf6925814785f4.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3636dbafd9e7d2c9fbcf6925814785f4.exe"
  2⤵
  PID:396
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IzlVwhlRIiJLdZ.exe"
  2⤵
  PID:3956
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IzlVwhlRIiJLdZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1863.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3912