Resubmissions

31-03-2022 20:37

220331-zel73sdfcn 10

31-03-2022 16:13

220331-tpjxtaafcp 10

Analysis

  • max time kernel
    312s
  • max time network
    358s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    31-03-2022 20:37

General

  • Target

    notice.exe

  • Size

    350.0MB

  • MD5

    e74116c5efc7492fa74334a39e22afe8

  • SHA1

    393e81a3d525e8b582355d855d2c367047e4e0b0

  • SHA256

    f644bef519fc0243633d13f18c97c96d76b95b6f2cbad2a2507fb8177b7e4d1d

  • SHA512

    64999f89597bed1857252b98ffd03fba27c9514af0fb430de3913a58e035d619823bcb45a4aa5ec89abdf807f89f9db57d3856e97885144992d03804d79a2352

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
    1⤵
    • Modifies data under HKEY_USERS
    PID:836
  • C:\Users\Admin\AppData\Local\Temp\notice.exe
    "C:\Users\Admin\AppData\Local\Temp\notice.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2200
    • C:\Users\Admin\AppData\Local\Temp\notice.exe
      C:\Users\Admin\AppData\Local\Temp\notice.exe
      2⤵
        PID:4536
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 240
          3⤵
          • Program crash
          PID:2932
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4536 -ip 4536
      1⤵
        PID:2328

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1216-134-0x0000000000690000-0x00000000006B8000-memory.dmp

        Filesize

        160KB

      • memory/1216-146-0x0000000005DF0000-0x0000000005EA2000-memory.dmp

        Filesize

        712KB

      • memory/1216-145-0x0000000005CE0000-0x0000000005D30000-memory.dmp

        Filesize

        320KB

      • memory/2200-138-0x0000000004E70000-0x0000000004E92000-memory.dmp

        Filesize

        136KB

      • memory/2200-144-0x0000000006CE0000-0x0000000006CFA000-memory.dmp

        Filesize

        104KB

      • memory/2200-139-0x0000000004F10000-0x0000000004F76000-memory.dmp

        Filesize

        408KB

      • memory/2200-140-0x00000000055C0000-0x0000000005626000-memory.dmp

        Filesize

        408KB

      • memory/2200-141-0x0000000005CF0000-0x0000000005D0E000-memory.dmp

        Filesize

        120KB

      • memory/2200-142-0x0000000002905000-0x0000000002907000-memory.dmp

        Filesize

        8KB

      • memory/2200-143-0x0000000007330000-0x00000000079AA000-memory.dmp

        Filesize

        6.5MB

      • memory/2200-137-0x0000000004F90000-0x00000000055B8000-memory.dmp

        Filesize

        6.2MB

      • memory/2200-136-0x0000000002880000-0x00000000028B6000-memory.dmp

        Filesize

        216KB

      • memory/4536-148-0x0000000000400000-0x0000000000465000-memory.dmp

        Filesize

        404KB

      • memory/4536-149-0x0000000000400000-0x0000000000465000-memory.dmp

        Filesize

        404KB

      • memory/4536-150-0x0000000000400000-0x0000000000465000-memory.dmp

        Filesize

        404KB