Analysis

  • max time kernel
    172s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    07/02/2022, 21:29

General

  • Target

    98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe

  • Size

    70KB

  • MD5

    083747a495f42e4d89c6f6640ddc0397

  • SHA1

    8a7f3873596c48b5b454daeee7fa160f551c239f

  • SHA256

    98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d

  • SHA512

    1c47cf2bf8b9de2fb180bfe81856b5e9d104f62eda88e1355ffead972029eb79abcf26de40ad61c373b42271b7713d402ec50cf20123f1d0ef2f0bc34c995938

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 47 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe
    "C:\Users\Admin\AppData\Local\Temp\98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3968
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5685.tmp\5686.bat C:\Users\Admin\AppData\Local\Temp\98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe"
      2⤵
        PID:3020
    • C:\Windows\system32\MusNotifyIcon.exe
      %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
      1⤵
      • Checks processor information in registry
      PID:816
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:3472

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads