aa69efc6d0e9dcf29dbf1894cadd436c295bc1ed05684fbf8731a9cb0e8d183e

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
24/02/2022, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2645a3827b3e3e8a4fd278ab1c1c4527.exe
Size 36KB
Sample220224-kwlkjsced9
SHA256 aa69efc6d0e9dcf29dbf1894cadd436c295bc1ed05684fbf8731a9cb0e8d183e
MD5 2645a3827b3e3e8a4fd278ab1c1c4527
SHA1 dc06f2131cfb565d3161e60cce41ed93c2831549
SHA512 45d8e79ba024986cc5db01b5876f271214a890f23a2cc04c1781400036217b2388970f2607dc2636f902f2fa3bbb0a36a0d12907c73e820c9978c61026167bf0
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1712	oobeldr.exe
1900	oobeldr.exe
4800	oobeldr.exe
1096	oobeldr.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	2645a3827b3e3e8a4fd278ab1c1c4527.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	oobeldr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	oobeldr.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 3876	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	97
PID 1712 set thread context of 1900	1712	oobeldr.exe	109
PID 4800 set thread context of 1096	4800	oobeldr.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
600	schtasks.exe
4596	schtasks.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
2312	timeout.exe
4532	timeout.exe
4372	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe
1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe
1712	oobeldr.exe
1712	oobeldr.exe
4800	oobeldr.exe
4800	oobeldr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe
Token: SeDebugPrivilege	1712	oobeldr.exe
Token: SeDebugPrivilege	4800	oobeldr.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 4460	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	82
PID 1044 wrote to memory of 4460	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	82
PID 1044 wrote to memory of 4460	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	82
PID 4460 wrote to memory of 4372	4460	cmd.exe	84
PID 4460 wrote to memory of 4372	4460	cmd.exe	84
PID 4460 wrote to memory of 4372	4460	cmd.exe	84
PID 1044 wrote to memory of 3876	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	97
PID 1044 wrote to memory of 3876	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	97
PID 1044 wrote to memory of 3876	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	97
PID 1044 wrote to memory of 3876	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	97
PID 1044 wrote to memory of 3876	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	97
PID 1044 wrote to memory of 3876	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	97
PID 1044 wrote to memory of 3876	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	97
PID 1044 wrote to memory of 3876	1044	2645a3827b3e3e8a4fd278ab1c1c4527.exe	97
PID 3876 wrote to memory of 4596	3876	2645a3827b3e3e8a4fd278ab1c1c4527.exe	98
PID 3876 wrote to memory of 4596	3876	2645a3827b3e3e8a4fd278ab1c1c4527.exe	98
PID 3876 wrote to memory of 4596	3876	2645a3827b3e3e8a4fd278ab1c1c4527.exe	98
PID 1712 wrote to memory of 3380	1712	oobeldr.exe	105
PID 1712 wrote to memory of 3380	1712	oobeldr.exe	105
PID 1712 wrote to memory of 3380	1712	oobeldr.exe	105
PID 3380 wrote to memory of 2312	3380	cmd.exe	107
PID 3380 wrote to memory of 2312	3380	cmd.exe	107
PID 3380 wrote to memory of 2312	3380	cmd.exe	107
PID 1712 wrote to memory of 1900	1712	oobeldr.exe	109
PID 1712 wrote to memory of 1900	1712	oobeldr.exe	109
PID 1712 wrote to memory of 1900	1712	oobeldr.exe	109
PID 1712 wrote to memory of 1900	1712	oobeldr.exe	109
PID 1712 wrote to memory of 1900	1712	oobeldr.exe	109
PID 1712 wrote to memory of 1900	1712	oobeldr.exe	109
PID 1712 wrote to memory of 1900	1712	oobeldr.exe	109
PID 1712 wrote to memory of 1900	1712	oobeldr.exe	109
PID 1900 wrote to memory of 600	1900	oobeldr.exe	110
PID 1900 wrote to memory of 600	1900	oobeldr.exe	110
PID 1900 wrote to memory of 600	1900	oobeldr.exe	110
PID 4800 wrote to memory of 4088	4800	oobeldr.exe	113
PID 4800 wrote to memory of 4088	4800	oobeldr.exe	113
PID 4800 wrote to memory of 4088	4800	oobeldr.exe	113
PID 4088 wrote to memory of 4532	4088	cmd.exe	115
PID 4088 wrote to memory of 4532	4088	cmd.exe	115
PID 4088 wrote to memory of 4532	4088	cmd.exe	115
PID 4800 wrote to memory of 1096	4800	oobeldr.exe	116
PID 4800 wrote to memory of 1096	4800	oobeldr.exe	116
PID 4800 wrote to memory of 1096	4800	oobeldr.exe	116
PID 4800 wrote to memory of 1096	4800	oobeldr.exe	116
PID 4800 wrote to memory of 1096	4800	oobeldr.exe	116
PID 4800 wrote to memory of 1096	4800	oobeldr.exe	116
PID 4800 wrote to memory of 1096	4800	oobeldr.exe	116
PID 4800 wrote to memory of 1096	4800	oobeldr.exe	116

C:\Users\Admin\AppData\Local\Temp\2645a3827b3e3e8a4fd278ab1c1c4527.exe
"C:\Users\Admin\AppData\Local\Temp\2645a3827b3e3e8a4fd278ab1c1c4527.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 20
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\timeout.exe
    timeout 20
    3⤵
    - Delays execution with timeout.exe
    PID:4372
- C:\Users\Admin\AppData\Local\Temp\2645a3827b3e3e8a4fd278ab1c1c4527.exe
  C:\Users\Admin\AppData\Local\Temp\2645a3827b3e3e8a4fd278ab1c1c4527.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4596

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 20
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\SysWOW64\timeout.exe
    timeout 20
    3⤵
    - Delays execution with timeout.exe
    PID:2312
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:600

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 20
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\timeout.exe
    timeout 20
    3⤵
    - Delays execution with timeout.exe
    PID:4532
- C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
  2⤵
  - Executes dropped EXE
  PID:1096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-131-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

Download

memory/1044-132-0x0000000004960000-0x0000000004961000-memory.dmp

Download

memory/1044-133-0x000000000C150000-0x000000000C1E2000-memory.dmp

Download

memory/1044-130-0x00000000001B0000-0x00000000001BE000-memory.dmp

Download

memory/1712-138-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

Download

memory/1712-139-0x0000000005CC0000-0x0000000005CC1000-memory.dmp

Download

memory/3876-135-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/3876-134-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/4800-145-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

Download

memory/4800-146-0x0000000005210000-0x0000000005211000-memory.dmp

Download