Resubmissions
01-09-2022 19:57
220901-ypp62scdh3 1013-06-2022 01:36
220613-b1kpdahbh9 1014-03-2022 23:17
220314-29pmssdeh2 8Analysis
-
max time kernel
211s -
max time network
217s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
14-03-2022 23:17
Static task
static1
Behavioral task
behavioral1
Sample
11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe
-
Size
256.0MB
-
MD5
0fa1be2db15ef78a9e01b21589204615
-
SHA1
933ad2d5ce1e31654a201b284abfc6ec88ad484c
-
SHA256
11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a
-
SHA512
13e51c96c51741348fa07d9072a686fc62d3f31af5d085893bce7247cd7de98d89e7d4318e69e7f4c3c3aa29ae41c9d6b1f98f73aab062dffbc7704a76e91be4
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1648 iywhilxe.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe -
Loads dropped DLL 6 IoCs
pid Process 1648 iywhilxe.exe 1648 iywhilxe.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe 4968 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: iywhilxe.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: iywhilxe.exe File opened (read-only) \??\J: iywhilxe.exe File opened (read-only) \??\Q: iywhilxe.exe File opened (read-only) \??\V: iywhilxe.exe File opened (read-only) \??\W: iywhilxe.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: iywhilxe.exe File opened (read-only) \??\M: iywhilxe.exe File opened (read-only) \??\O: iywhilxe.exe File opened (read-only) \??\S: iywhilxe.exe File opened (read-only) \??\U: iywhilxe.exe File opened (read-only) \??\X: iywhilxe.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: iywhilxe.exe File opened (read-only) \??\N: iywhilxe.exe File opened (read-only) \??\P: iywhilxe.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: iywhilxe.exe File opened (read-only) \??\I: iywhilxe.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\F: iywhilxe.exe File opened (read-only) \??\Z: iywhilxe.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: iywhilxe.exe File opened (read-only) \??\L: iywhilxe.exe File opened (read-only) \??\Y: iywhilxe.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: iywhilxe.exe File opened (read-only) \??\R: iywhilxe.exe File opened (read-only) \??\A: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 59 IoCs
description pid Process Token: SeCreateTokenPrivilege 1648 iywhilxe.exe Token: SeAssignPrimaryTokenPrivilege 1648 iywhilxe.exe Token: SeLockMemoryPrivilege 1648 iywhilxe.exe Token: SeIncreaseQuotaPrivilege 1648 iywhilxe.exe Token: SeMachineAccountPrivilege 1648 iywhilxe.exe Token: SeTcbPrivilege 1648 iywhilxe.exe Token: SeSecurityPrivilege 1648 iywhilxe.exe Token: SeTakeOwnershipPrivilege 1648 iywhilxe.exe Token: SeLoadDriverPrivilege 1648 iywhilxe.exe Token: SeSystemProfilePrivilege 1648 iywhilxe.exe Token: SeSystemtimePrivilege 1648 iywhilxe.exe Token: SeProfSingleProcessPrivilege 1648 iywhilxe.exe Token: SeIncBasePriorityPrivilege 1648 iywhilxe.exe Token: SeCreatePagefilePrivilege 1648 iywhilxe.exe Token: SeCreatePermanentPrivilege 1648 iywhilxe.exe Token: SeBackupPrivilege 1648 iywhilxe.exe Token: SeRestorePrivilege 1648 iywhilxe.exe Token: SeShutdownPrivilege 1648 iywhilxe.exe Token: SeDebugPrivilege 1648 iywhilxe.exe Token: SeAuditPrivilege 1648 iywhilxe.exe Token: SeSystemEnvironmentPrivilege 1648 iywhilxe.exe Token: SeChangeNotifyPrivilege 1648 iywhilxe.exe Token: SeRemoteShutdownPrivilege 1648 iywhilxe.exe Token: SeUndockPrivilege 1648 iywhilxe.exe Token: SeSyncAgentPrivilege 1648 iywhilxe.exe Token: SeEnableDelegationPrivilege 1648 iywhilxe.exe Token: SeManageVolumePrivilege 1648 iywhilxe.exe Token: SeImpersonatePrivilege 1648 iywhilxe.exe Token: SeCreateGlobalPrivilege 1648 iywhilxe.exe Token: SeSecurityPrivilege 4160 msiexec.exe Token: SeCreateTokenPrivilege 1648 iywhilxe.exe Token: SeAssignPrimaryTokenPrivilege 1648 iywhilxe.exe Token: SeLockMemoryPrivilege 1648 iywhilxe.exe Token: SeIncreaseQuotaPrivilege 1648 iywhilxe.exe Token: SeMachineAccountPrivilege 1648 iywhilxe.exe Token: SeTcbPrivilege 1648 iywhilxe.exe Token: SeSecurityPrivilege 1648 iywhilxe.exe Token: SeTakeOwnershipPrivilege 1648 iywhilxe.exe Token: SeLoadDriverPrivilege 1648 iywhilxe.exe Token: SeSystemProfilePrivilege 1648 iywhilxe.exe Token: SeSystemtimePrivilege 1648 iywhilxe.exe Token: SeProfSingleProcessPrivilege 1648 iywhilxe.exe Token: SeIncBasePriorityPrivilege 1648 iywhilxe.exe Token: SeCreatePagefilePrivilege 1648 iywhilxe.exe Token: SeCreatePermanentPrivilege 1648 iywhilxe.exe Token: SeBackupPrivilege 1648 iywhilxe.exe Token: SeRestorePrivilege 1648 iywhilxe.exe Token: SeShutdownPrivilege 1648 iywhilxe.exe Token: SeDebugPrivilege 1648 iywhilxe.exe Token: SeAuditPrivilege 1648 iywhilxe.exe Token: SeSystemEnvironmentPrivilege 1648 iywhilxe.exe Token: SeChangeNotifyPrivilege 1648 iywhilxe.exe Token: SeRemoteShutdownPrivilege 1648 iywhilxe.exe Token: SeUndockPrivilege 1648 iywhilxe.exe Token: SeSyncAgentPrivilege 1648 iywhilxe.exe Token: SeEnableDelegationPrivilege 1648 iywhilxe.exe Token: SeManageVolumePrivilege 1648 iywhilxe.exe Token: SeImpersonatePrivilege 1648 iywhilxe.exe Token: SeCreateGlobalPrivilege 1648 iywhilxe.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1648 iywhilxe.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4684 wrote to memory of 1648 4684 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 81 PID 4684 wrote to memory of 1648 4684 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 81 PID 4684 wrote to memory of 1648 4684 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 81 PID 4684 wrote to memory of 2096 4684 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 82 PID 4684 wrote to memory of 2096 4684 11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe 82 PID 4160 wrote to memory of 4968 4160 msiexec.exe 88 PID 4160 wrote to memory of 4968 4160 msiexec.exe 88 PID 4160 wrote to memory of 4968 4160 msiexec.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe"C:\Users\Admin\AppData\Local\Temp\11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\iywhilxe.exe"C:\Users\Admin\AppData\Local\Temp\iywhilxe.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1648
-
-
C:\Users\Admin\AppData\Local\Temp\11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe"C:\Users\Admin\AppData\Local\Temp\11543f09c416237d92090cebbefafdb2f03cec72a6f3fdedf8afe3c315181b5a.exe" /i2⤵PID:2096
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D599747AE07E568B21011604C2E0B2EA C2⤵
- Loads dropped DLL
PID:4968
-