Analysis
-
max time kernel
40s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20-02-2022 09:55
Static task
static1
Behavioral task
behavioral1
Sample
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe
Resource
win10v2004-en-20220113
General
-
Target
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe
-
Size
155KB
-
MD5
c5609ab395ee733f889c28d9f93f2af3
-
SHA1
ee4099fc9381c45aaa32505521a8dbc1daf3ff78
-
SHA256
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992
-
SHA512
39fa80bc077b24b1f8814b19722613b472343dded1fd14b1231e11a6b03c2ae477db2f787a4f2d72b39b611c2070ad833068e2e01fd18e9cab257414e2ce1caf
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exepid process 4516 1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe 4516 1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exedescription pid process Token: SeDebugPrivilege 4516 1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.execmd.exedescription pid process target process PID 4516 wrote to memory of 4264 4516 1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe cmd.exe PID 4516 wrote to memory of 4264 4516 1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe cmd.exe PID 4516 wrote to memory of 2380 4516 1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe sihost.exe PID 4264 wrote to memory of 1700 4264 cmd.exe reg.exe PID 4264 wrote to memory of 1700 4264 cmd.exe reg.exe PID 4516 wrote to memory of 2408 4516 1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe svchost.exe PID 4516 wrote to memory of 2704 4516 1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe taskhostw.exe PID 4516 wrote to memory of 2604 4516 1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe svchost.exe PID 4516 wrote to memory of 3236 4516 1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe DllHost.exe
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe"C:\Users\Admin\AppData\Local\Temp\1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1659503da5d0318c6025ea87b125b4917d53f4f666461b42d7cc2552ac2b3992.exe" /f3⤵
- Adds Run key to start application