a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510

General

Target
a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe
Size 171KB
Sample220220-egaa3sgde5
SHA256 a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510
MD5 567407d941d99abeff20a1b836570d30
SHA1 e8866fda01f91c6d4bf8c51cf4cbc7f103e87b0b
SHA512 514cc28f8da0e8bf054bf0a0963c4253a16df1d5cb8e87dd09294ab97d8e1b5b5fc18c54920a3829d40b0bdda5837567a73b39b4d1839ab919d672ceaf32989b
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2444	a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe
2444	a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2444	a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2280	2444	a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe	84
PID 2444 wrote to memory of 2280	2444	a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe	84
PID 2444 wrote to memory of 2316	2444	a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe	52
PID 2280 wrote to memory of 3000	2280	cmd.exe	86
PID 2280 wrote to memory of 3000	2280	cmd.exe	86
PID 2444 wrote to memory of 2332	2444	a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe	51
PID 2444 wrote to memory of 2472	2444	a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe	48
PID 2444 wrote to memory of 2624	2444	a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe	43

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2624

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2332

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2316

C:\Users\Admin\AppData\Local\Temp\a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe
"C:\Users\Admin\AppData\Local\Temp\a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\a0dccbe010859116063fc3f7e00c8c7bd68b849eeb7238a10b1b9f07f5c36510.exe" /f
    3⤵
    PID:3000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-130-0x00007FF7790A0000-0x00007FF77942E000-memory.dmp

Download

memory/2332-131-0x00007FF7790A0000-0x00007FF77942E000-memory.dmp