Overview

overview

10

Static

static

b7e945a8da...a1.exe

windows7_x64

10

b7e945a8da...a1.exe

windows10-2004_x64

7

Analysis

  • max time kernel
    37s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    20-02-2022 02:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b7e945a8dafc91ebe8c8717ee3107498afc1ad5461599611d2fb07aaa7700aa1.exe

  • Size

    151KB

  • MD5

    2af0f010e71cb1ecddc52b13e4149ea2

  • SHA1

    6caead7f091d18baa393cdea1955d43fd7853850

  • SHA256

    b7e945a8dafc91ebe8c8717ee3107498afc1ad5461599611d2fb07aaa7700aa1

  • SHA512

    72856c70b931cbb1e0bf6c006cb959d7735cde779d40e56964e58578daf91ac0e0cbf8f3fb05efba3afe7400e3f2450acc98b711f1b29b2a9fb891ae86b13f66

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    1⤵
      PID:3364
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
      1⤵
        PID:3160
      • C:\Windows\system32\taskhostw.exe
        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
        1⤵
          PID:2688
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
          1⤵
            PID:2408
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
              PID:2360
            • C:\Users\Admin\AppData\Local\Temp\b7e945a8dafc91ebe8c8717ee3107498afc1ad5461599611d2fb07aaa7700aa1.exe
              "C:\Users\Admin\AppData\Local\Temp\b7e945a8dafc91ebe8c8717ee3107498afc1ad5461599611d2fb07aaa7700aa1.exe"
              1⤵
              • Checks computer location settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4536
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b7e945a8dafc91ebe8c8717ee3107498afc1ad5461599611d2fb07aaa7700aa1.exe" /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1516
                • C:\Windows\system32\reg.exe
                  REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b7e945a8dafc91ebe8c8717ee3107498afc1ad5461599611d2fb07aaa7700aa1.exe" /f
                  3⤵
                    PID:2716

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Initial Access

              Execution

              Persistence

              Privilege Escalation

              Defense Evasion

              Credential Access

              Discovery

              Query Registry

              1
              T1012

              System Information Discovery

              2
              T1082

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2360-130-0x00007FF7933F0000-0x00007FF793779000-memory.dmp
                Filesize

                3.5MB

                Download