Analysis
-
max time kernel
165s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-05-2022 22:33
Static task
static1
Behavioral task
behavioral1
Sample
3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe
Resource
win10v2004-20220414-en
General
-
Target
3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe
-
Size
1.3MB
-
MD5
b4fb0f1fa17aba09434c3dd447869137
-
SHA1
b860c2a05518a30a1bfba0ee83f18ab2ce5cf239
-
SHA256
3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a
-
SHA512
97f9dfc5e934ec6405dd23d254d33752517d8b416dc7038306655c9b3e9f5ba958fb4512a4e0d76e2d9f9ce11fe7fbe3104f43453ebadc4d0cf27e2a404b0b99
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation cmd.exe -
Drops file in Windows directory 1 IoCs
Processes:
mspaint.exedescription ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mspaint.exepid Process 5116 mspaint.exe 5116 mspaint.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exemspaint.exepid Process 1832 3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe 1832 3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe 1832 3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe 1832 3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe 5116 mspaint.exe 5116 mspaint.exe 5116 mspaint.exe 5116 mspaint.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.execmd.exedescription pid Process procid_target PID 1832 wrote to memory of 4288 1832 3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe 81 PID 1832 wrote to memory of 4288 1832 3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe 81 PID 1832 wrote to memory of 4288 1832 3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe 81 PID 4288 wrote to memory of 5116 4288 cmd.exe 83 PID 4288 wrote to memory of 5116 4288 cmd.exe 83 PID 4288 wrote to memory of 5116 4288 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe"C:\Users\Admin\AppData\Local\Temp\3df02c782366fd5761b0454eec884a8d503814608126b36aa0a385949cc43e9a.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\RECEIPT.bmp2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RECEIPT.bmp"3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5116
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4496