0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d

Analysis

max time kernel
39s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19/02/2022, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe
Size

170KB
MD5

c67b278a1c92b57c93b4b2e5bb2feae2
SHA1

5c31aee33dcacca12c89208d51f5d63bff687707
SHA256

0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d
SHA512

6156b49fc0702fdd6db18fbc99231c5d6e061a9d0b5c7a8644540386ba399a2a00365c973ff8f1d5459d08c239283ed6c01ad46b58441eade4020f7fb965a29d

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1392	0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe
1392	0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 3112	1392	0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe	85
PID 1392 wrote to memory of 3112	1392	0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe	85
PID 1392 wrote to memory of 2336	1392	0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe	60
PID 3112 wrote to memory of 1728	3112	cmd.exe	87
PID 3112 wrote to memory of 1728	3112	cmd.exe	87
PID 1392 wrote to memory of 2344	1392	0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe	59
PID 1392 wrote to memory of 2432	1392	0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe	24

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2432

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2336

C:\Users\Admin\AppData\Local\Temp\0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe
"C:\Users\Admin\AppData\Local\Temp\0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\0058e795e91f14f3adc60502c50acf16fc927362c65df5f5a341e69c0b83813d.exe" /f
    3⤵
    PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-130-0x00007FF770F60000-0x00007FF7712EE000-memory.dmp

Filesize
3.6MB

Download