Analysis
-
max time kernel
158s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:45
Static task
static1
Behavioral task
behavioral1
Sample
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe
Resource
win10v2004-20220414-en
General
-
Target
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe
-
Size
156KB
-
MD5
155f99e5dd86820942fa5e1f05ae1bbe
-
SHA1
65100fad9ea9e59ece5ac703a0ee60ae8440245c
-
SHA256
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564
-
SHA512
29d0286b6714e32e4d82ececfe9e9730c4c51c76b443291dce0c911b7299664e6e16a58cc833a4f259fa8d432bc66beb2b7d04a0676515a30e5c9d70b11333ad
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
untitled.exepid process 4156 untitled.exe -
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe -
Drops startup file 2 IoCs
Processes:
untitled.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b72703673af5d475a624599b0b805a17.exe untitled.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b72703673af5d475a624599b0b805a17.exe untitled.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
untitled.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b72703673af5d475a624599b0b805a17 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\untitled.exe\" .." untitled.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b72703673af5d475a624599b0b805a17 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\untitled.exe\" .." untitled.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exepid process 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exeuntitled.exedescription pid process Token: SeDebugPrivilege 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe Token: SeDebugPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe Token: 33 4156 untitled.exe Token: SeIncBasePriorityPrivilege 4156 untitled.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exeuntitled.exedescription pid process target process PID 4076 wrote to memory of 4156 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe untitled.exe PID 4076 wrote to memory of 4156 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe untitled.exe PID 4076 wrote to memory of 4156 4076 9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe untitled.exe PID 4156 wrote to memory of 1068 4156 untitled.exe netsh.exe PID 4156 wrote to memory of 1068 4156 untitled.exe netsh.exe PID 4156 wrote to memory of 1068 4156 untitled.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe"C:\Users\Admin\AppData\Local\Temp\9c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\untitled.exe"C:\Users\Admin\AppData\Local\Temp\untitled.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\untitled.exe" "untitled.exe" ENABLE3⤵PID:1068
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\untitled.exeFilesize
156KB
MD5155f99e5dd86820942fa5e1f05ae1bbe
SHA165100fad9ea9e59ece5ac703a0ee60ae8440245c
SHA2569c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564
SHA51229d0286b6714e32e4d82ececfe9e9730c4c51c76b443291dce0c911b7299664e6e16a58cc833a4f259fa8d432bc66beb2b7d04a0676515a30e5c9d70b11333ad
-
C:\Users\Admin\AppData\Local\Temp\untitled.exeFilesize
156KB
MD5155f99e5dd86820942fa5e1f05ae1bbe
SHA165100fad9ea9e59ece5ac703a0ee60ae8440245c
SHA2569c1ad6aeb064c615267597bdd27e8cc0f0b8d3b4a96437b6dffdc5dc3fc27564
SHA51229d0286b6714e32e4d82ececfe9e9730c4c51c76b443291dce0c911b7299664e6e16a58cc833a4f259fa8d432bc66beb2b7d04a0676515a30e5c9d70b11333ad
-
memory/1068-135-0x0000000000000000-mapping.dmp
-
memory/4076-130-0x00000000750E0000-0x0000000075691000-memory.dmpFilesize
5.7MB
-
memory/4156-131-0x0000000000000000-mapping.dmp
-
memory/4156-134-0x00000000750E0000-0x0000000075691000-memory.dmpFilesize
5.7MB