Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:27
Static task
static1
Behavioral task
behavioral1
Sample
order 20- 0011718..exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
order 20- 0011718..exe
Resource
win10v2004-20220414-en
General
-
Target
order 20- 0011718..exe
-
Size
426KB
-
MD5
583a510813764348af0c5c3d2b6f9385
-
SHA1
be80f78c782d612fca9128cdfefc9b324ae653eb
-
SHA256
aec020a6546f4efe2d5766ae7e7da2816c11badee1879d37de7845538b03035b
-
SHA512
b82acd5b8e864c0b83be494d88cd97f891cd1a5e47acbb5a425af353d3c9e7d868be10da0fd0c568de1e3478460be690ff0b648865b7f136983b434ce24fe32e
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
order 20- 0011718..exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation order 20- 0011718..exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
order 20- 0011718..exepid process 2772 order 20- 0011718..exe 2772 order 20- 0011718..exe 2772 order 20- 0011718..exe 2772 order 20- 0011718..exe 2772 order 20- 0011718..exe 2772 order 20- 0011718..exe 2772 order 20- 0011718..exe 2772 order 20- 0011718..exe 2772 order 20- 0011718..exe 2772 order 20- 0011718..exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
order 20- 0011718..exedescription pid process Token: SeDebugPrivilege 2772 order 20- 0011718..exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
order 20- 0011718..exedescription pid process target process PID 2772 wrote to memory of 3652 2772 order 20- 0011718..exe schtasks.exe PID 2772 wrote to memory of 3652 2772 order 20- 0011718..exe schtasks.exe PID 2772 wrote to memory of 3652 2772 order 20- 0011718..exe schtasks.exe PID 2772 wrote to memory of 5028 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 5028 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 5028 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 3488 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 3488 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 3488 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 4052 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 4052 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 4052 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 2232 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 2232 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 2232 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 2292 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 2292 2772 order 20- 0011718..exe order 20- 0011718..exe PID 2772 wrote to memory of 2292 2772 order 20- 0011718..exe order 20- 0011718..exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\order 20- 0011718..exe"C:\Users\Admin\AppData\Local\Temp\order 20- 0011718..exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AaLebGET" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5FB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\order 20- 0011718..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\order 20- 0011718..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\order 20- 0011718..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\order 20- 0011718..exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\order 20- 0011718..exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5FB.tmpFilesize
1KB
MD54d0ba98876f17d87636dd32c8133293f
SHA1192bb21b71b5014d1d78636193b18d2115991d56
SHA256401df05d30961042b7665e67d5017dfaa673184fb88332f0993793da555effa0
SHA5125d03a691d1e24dbe0ced55d0614dc6900b812e2498fe3da1bb18821f6aa5588400612afd107f642fbac994409021f8e81b5fc1de97bca6f773695b0346a67175
-
memory/2232-139-0x0000000000000000-mapping.dmp
-
memory/2292-140-0x0000000000000000-mapping.dmp
-
memory/2772-130-0x0000000000960000-0x00000000009D0000-memory.dmpFilesize
448KB
-
memory/2772-131-0x0000000005260000-0x00000000052FC000-memory.dmpFilesize
624KB
-
memory/2772-132-0x00000000053A0000-0x0000000005432000-memory.dmpFilesize
584KB
-
memory/2772-133-0x0000000006270000-0x0000000006814000-memory.dmpFilesize
5.6MB
-
memory/3488-137-0x0000000000000000-mapping.dmp
-
memory/3652-134-0x0000000000000000-mapping.dmp
-
memory/4052-138-0x0000000000000000-mapping.dmp
-
memory/5028-136-0x0000000000000000-mapping.dmp