Analysis
-
max time kernel
90s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:19
Static task
static1
Behavioral task
behavioral1
Sample
New Offer.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
New Offer.exe
Resource
win10v2004-20220414-en
General
-
Target
New Offer.exe
-
Size
827KB
-
MD5
c5eda9db6db46c98570bc8bcaed6f3a6
-
SHA1
8bbefc64626568c0a73b095d874f1b00633f7eb1
-
SHA256
6d501548a8060835c3a3d65281d905a189d6ebb7f2c79e0ae76d59872c1cc0b3
-
SHA512
060001790d3e9991ad4a47ae18386048d98fb47350958e03e66e85ded94208145e0e68477d2cfe91ef63879faf71d1cad70465531fb5635f7e97503caaf4cf85
Malware Config
Signatures
-
CoreCCC Packer 1 IoCs
Detects CoreCCC packer used to load .NET malware.
Processes:
resource yara_rule behavioral2/memory/1940-130-0x00000000003A0000-0x0000000000476000-memory.dmp coreccc -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
New Offer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation New Offer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
New Offer.exedescription pid process target process PID 1940 set thread context of 1012 1940 New Offer.exe New Offer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
New Offer.exepid process 1940 New Offer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New Offer.exeNew Offer.exedescription pid process Token: SeDebugPrivilege 1940 New Offer.exe Token: SeDebugPrivilege 1012 New Offer.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
New Offer.exedescription pid process target process PID 1940 wrote to memory of 4288 1940 New Offer.exe schtasks.exe PID 1940 wrote to memory of 4288 1940 New Offer.exe schtasks.exe PID 1940 wrote to memory of 4288 1940 New Offer.exe schtasks.exe PID 1940 wrote to memory of 1012 1940 New Offer.exe New Offer.exe PID 1940 wrote to memory of 1012 1940 New Offer.exe New Offer.exe PID 1940 wrote to memory of 1012 1940 New Offer.exe New Offer.exe PID 1940 wrote to memory of 1012 1940 New Offer.exe New Offer.exe PID 1940 wrote to memory of 1012 1940 New Offer.exe New Offer.exe PID 1940 wrote to memory of 1012 1940 New Offer.exe New Offer.exe PID 1940 wrote to memory of 1012 1940 New Offer.exe New Offer.exe PID 1940 wrote to memory of 1012 1940 New Offer.exe New Offer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Offer.exe"C:\Users\Admin\AppData\Local\Temp\New Offer.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DwoNkS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9D9C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\New Offer.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9D9C.tmpFilesize
1KB
MD53e2e369f9dd0740b146f6c5cb09bf1f8
SHA1f3b92610eea2a832e55469c2e8008c410f7c8ab3
SHA256996ee9ffc6f06f8ecf34e42adf8ec09b77682f2f48f69d5cc1176b31968b210d
SHA51229a33bdf1fb5a593618eaa1b9b92ed830fa5a9a0cc8101d109cb24ae34fea648ed851d0fa9bcf8f2419e8500f6aa40e011416c603f33a8aac17fb6ef034696b8
-
memory/1012-162-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-190-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-200-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-160-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-196-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-194-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-137-0x0000000000000000-mapping.dmp
-
memory/1012-138-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-140-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-142-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-144-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-146-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-148-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-164-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-152-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-154-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-156-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-158-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-198-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-192-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-150-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-166-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-168-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-170-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-172-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-174-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-176-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-178-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-180-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-182-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-184-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-186-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1012-188-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1940-130-0x00000000003A0000-0x0000000000476000-memory.dmpFilesize
856KB
-
memory/1940-132-0x0000000004E10000-0x0000000004EA2000-memory.dmpFilesize
584KB
-
memory/1940-131-0x00000000054B0000-0x0000000005A54000-memory.dmpFilesize
5.6MB
-
memory/1940-134-0x00000000085D0000-0x000000000866C000-memory.dmpFilesize
624KB
-
memory/1940-133-0x0000000004EC0000-0x0000000004ECA000-memory.dmpFilesize
40KB
-
memory/4288-135-0x0000000000000000-mapping.dmp