Analysis

  • max time kernel
    170s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    20-02-2022 05:29

General

  • Target

    7a6c6890028ab340f918ef1116a4db9cc852d899290bd1e99b0b8565553768ab.exe

  • Size

    111KB

  • MD5

    cb5081d3b8af578c247dab9bd5e16841

  • SHA1

    b4870d7b1f6a9f531259efc74a9468d8a045d8f0

  • SHA256

    7a6c6890028ab340f918ef1116a4db9cc852d899290bd1e99b0b8565553768ab

  • SHA512

    5bd6e7f2e04abb6d1d5f640730f7d60c1f202b6440e0888bba15708b4b88acb669a138aaf31d5782ce6409ab74970614970cda99dde1ef757299a4f61b257f28

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a6c6890028ab340f918ef1116a4db9cc852d899290bd1e99b0b8565553768ab.exe
    "C:\Users\Admin\AppData\Local\Temp\7a6c6890028ab340f918ef1116a4db9cc852d899290bd1e99b0b8565553768ab.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Users\Admin\AppData\Local\Temp\RasgMWNaGlan.exe
      "C:\Users\Admin\AppData\Local\Temp\RasgMWNaGlan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:1936
    • C:\Users\Admin\AppData\Local\Temp\fxhrazOTClan.exe
      "C:\Users\Admin\AppData\Local\Temp\fxhrazOTClan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:3264
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "WMIC.exe shadowcopy delete"
      2⤵
        PID:2916
    • C:\Windows\system32\MusNotifyIcon.exe
      %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
      1⤵
        PID:3316

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\RasgMWNaGlan.exe

        MD5

        cb5081d3b8af578c247dab9bd5e16841

        SHA1

        b4870d7b1f6a9f531259efc74a9468d8a045d8f0

        SHA256

        7a6c6890028ab340f918ef1116a4db9cc852d899290bd1e99b0b8565553768ab

        SHA512

        5bd6e7f2e04abb6d1d5f640730f7d60c1f202b6440e0888bba15708b4b88acb669a138aaf31d5782ce6409ab74970614970cda99dde1ef757299a4f61b257f28

      • C:\Users\Admin\AppData\Local\Temp\RasgMWNaGlan.exe

        MD5

        cb5081d3b8af578c247dab9bd5e16841

        SHA1

        b4870d7b1f6a9f531259efc74a9468d8a045d8f0

        SHA256

        7a6c6890028ab340f918ef1116a4db9cc852d899290bd1e99b0b8565553768ab

        SHA512

        5bd6e7f2e04abb6d1d5f640730f7d60c1f202b6440e0888bba15708b4b88acb669a138aaf31d5782ce6409ab74970614970cda99dde1ef757299a4f61b257f28

      • C:\Users\Admin\AppData\Local\Temp\fxhrazOTClan.exe

        MD5

        cb5081d3b8af578c247dab9bd5e16841

        SHA1

        b4870d7b1f6a9f531259efc74a9468d8a045d8f0

        SHA256

        7a6c6890028ab340f918ef1116a4db9cc852d899290bd1e99b0b8565553768ab

        SHA512

        5bd6e7f2e04abb6d1d5f640730f7d60c1f202b6440e0888bba15708b4b88acb669a138aaf31d5782ce6409ab74970614970cda99dde1ef757299a4f61b257f28

      • C:\Users\Admin\AppData\Local\Temp\fxhrazOTClan.exe

        MD5

        cb5081d3b8af578c247dab9bd5e16841

        SHA1

        b4870d7b1f6a9f531259efc74a9468d8a045d8f0

        SHA256

        7a6c6890028ab340f918ef1116a4db9cc852d899290bd1e99b0b8565553768ab

        SHA512

        5bd6e7f2e04abb6d1d5f640730f7d60c1f202b6440e0888bba15708b4b88acb669a138aaf31d5782ce6409ab74970614970cda99dde1ef757299a4f61b257f28