Analysis
-
max time kernel
64s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20-02-2022 06:35
Static task
static1
Behavioral task
behavioral1
Sample
62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe
Resource
win10v2004-en-20220113
General
-
Target
62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe
-
Size
170KB
-
MD5
0b7cd7bb98886561c8115f24b5bcd387
-
SHA1
77a36353a0998388e56e849f6c05e4d7ca8c81e7
-
SHA256
62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152
-
SHA512
3812e6817c2f651c3f0434972eb223474a902a019acccb6143fa495f4d4b7a4a768866da2bb53f4c071792ca6d4d2e500c4e9a910d61999f9d549f1a9bfb3366
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exepid process 4824 62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe 4824 62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exedescription pid process Token: SeDebugPrivilege 4824 62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.execmd.exedescription pid process target process PID 4824 wrote to memory of 1180 4824 62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe cmd.exe PID 4824 wrote to memory of 1180 4824 62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe cmd.exe PID 4824 wrote to memory of 2340 4824 62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe sihost.exe PID 1180 wrote to memory of 4764 1180 cmd.exe reg.exe PID 1180 wrote to memory of 4764 1180 cmd.exe reg.exe PID 4824 wrote to memory of 2356 4824 62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe svchost.exe PID 4824 wrote to memory of 2432 4824 62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe taskhostw.exe PID 4824 wrote to memory of 2800 4824 62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe svchost.exe PID 4824 wrote to memory of 3252 4824 62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe DllHost.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe"C:\Users\Admin\AppData\Local\Temp\62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\62c8958fc79972b987a313db8c94d9db5d11a5178234bce328ebe56dce330152.exe" /f3⤵
- Adds Run key to start application