Overview

overview

10

Static

static

b0fa28ac0f...aa.exe

windows7_x64

10

b0fa28ac0f...aa.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 23:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b0fa28ac0f0657906df6312a22baf99111cbf27afeaab98c92eeba4b07fddeaa.exe

  • Size

    212KB

  • MD5

    3ac926d3bca5450ce48d10c253700ae4

  • SHA1

    0a918e434b1f8e125fb23a71c7317e6b16f3df23

  • SHA256

    b0fa28ac0f0657906df6312a22baf99111cbf27afeaab98c92eeba4b07fddeaa

  • SHA512

    ef62bc011a2fdff15b466f798bcbe5c4308e925fb1240d7621f65ede89432a329e00c80a917cc5be401b7029a2c5a497a9bc09436c3f1c05259a2e3479c581c5

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0fa28ac0f0657906df6312a22baf99111cbf27afeaab98c92eeba4b07fddeaa.exe
    "C:\Users\Admin\AppData\Local\Temp\b0fa28ac0f0657906df6312a22baf99111cbf27afeaab98c92eeba4b07fddeaa.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -start
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3240
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 1400
        3⤵
        • Program crash
        PID:1540
    • C:\Windows\SysWOW64\notepad.exe
      notepad.exe
      2⤵
        PID:2800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3240 -ip 3240
      1⤵
        PID:3716

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
        Filesize

        212KB

        MD5

        3ac926d3bca5450ce48d10c253700ae4

        SHA1

        0a918e434b1f8e125fb23a71c7317e6b16f3df23

        SHA256

        b0fa28ac0f0657906df6312a22baf99111cbf27afeaab98c92eeba4b07fddeaa

        SHA512

        ef62bc011a2fdff15b466f798bcbe5c4308e925fb1240d7621f65ede89432a329e00c80a917cc5be401b7029a2c5a497a9bc09436c3f1c05259a2e3479c581c5

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
        Filesize

        212KB

        MD5

        3ac926d3bca5450ce48d10c253700ae4

        SHA1

        0a918e434b1f8e125fb23a71c7317e6b16f3df23

        SHA256

        b0fa28ac0f0657906df6312a22baf99111cbf27afeaab98c92eeba4b07fddeaa

        SHA512

        ef62bc011a2fdff15b466f798bcbe5c4308e925fb1240d7621f65ede89432a329e00c80a917cc5be401b7029a2c5a497a9bc09436c3f1c05259a2e3479c581c5

        Download Submit

      • memory/2800-133-0x0000000000000000-mapping.dmp

        Download

      • memory/3240-130-0x0000000000000000-mapping.dmp

        Download