Analysis
-
max time kernel
66s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20-02-2022 08:45
Static task
static1
Behavioral task
behavioral1
Sample
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe
Resource
win10v2004-en-20220113
General
-
Target
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe
-
Size
170KB
-
MD5
dd72a10cf4ee779c179d23ed6f4fdb01
-
SHA1
adc7691b97f34a9d55a3f7ca8a60e1c8756e3631
-
SHA256
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781
-
SHA512
e63d0a3a3bad2a0899d2e815ef2bf13b2e9c7fa5fcf79194b58438120d8096d894905c63ca4eeb1ebe0d47a6b1b5a085d0936445a8a00e34e07f22b494d4c41e
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exepid process 4228 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe 4228 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exedescription pid process Token: SeDebugPrivilege 4228 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.execmd.exedescription pid process target process PID 4228 wrote to memory of 2040 4228 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe cmd.exe PID 4228 wrote to memory of 2040 4228 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe cmd.exe PID 4228 wrote to memory of 2380 4228 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe sihost.exe PID 2040 wrote to memory of 2212 2040 cmd.exe reg.exe PID 2040 wrote to memory of 2212 2040 cmd.exe reg.exe PID 4228 wrote to memory of 2408 4228 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe svchost.exe PID 4228 wrote to memory of 2704 4228 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe taskhostw.exe PID 4228 wrote to memory of 2604 4228 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe svchost.exe PID 4228 wrote to memory of 3236 4228 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe DllHost.exe
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:2604
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2408
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe"C:\Users\Admin\AppData\Local\Temp\30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe" /f3⤵PID:2212