1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f

General

Target

1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe
Size

365KB
MD5

1ad8e8ffcb516c05d9a882f0e9902a3c
SHA1

19e98c4c807391a97ee58b83a99c476e2129fde3
SHA256

1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f
SHA512

eb291f57c95dfa3a96f1637a30ec401b5959694f5000546ad7cd687f2f5c05bf6746d1c449cb660a8ff8dff32c30e28e3e1fc57184ab5b97bc9422122f3e12c3

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: RenamesItself 1 IoCs

Processes:

1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe

pid process

3480 1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe

pid	process
3480	1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exesvchost.exe

description	pid	process
Token: SeShutdownPrivilege	3480	1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe
Token: SeCreatePagefilePrivilege	3480	1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe
Token: SeShutdownPrivilege	5004	svchost.exe
Token: SeCreatePagefilePrivilege	5004	svchost.exe
Token: SeShutdownPrivilege	5004	svchost.exe
Token: SeCreatePagefilePrivilege	5004	svchost.exe
Token: SeShutdownPrivilege	5004	svchost.exe
Token: SeCreatePagefilePrivilege	5004	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe

description	pid	process	target process
PID 3480 wrote to memory of 3436	3480	1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe	cmd.exe
PID 3480 wrote to memory of 3436	3480	1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe	cmd.exe
PID 3480 wrote to memory of 3436	3480	1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe
"C:\Users\Admin\AppData\Local\Temp\1455d721053cee74b69135a6ce0db0a35e8ec612a7f5a7bbd50ae80731c11d6f.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XzTTZsKklVMbFY6q.bat" "
  2⤵
  PID:3436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XzTTZsKklVMbFY6q.bat

MD5
bb47b23e393a23f33687c4d14af8375a

SHA1
8973449916420be604afc590c021567a4581cc6e

SHA256
3041d0c46d203fc893dd9ee6212f8d41227c651df76f72314524b925732a419f

SHA512
11d0f77d28fe27bd1930da07d23ed7bd17e213d572406b727ffa1a447af4e6ea9afa41a35aa54a00091de5ce22cf028b295903568a7c3ba9cfe623bc4a11d001

Download Submit
memory/5004-143-0x000001CA70A60000-0x000001CA70A64000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads