Analysis
-
max time kernel
101s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:39
Static task
static1
Behavioral task
behavioral1
Sample
deiUUj8mpdyf36k.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
deiUUj8mpdyf36k.exe
Resource
win10v2004-20220414-en
General
-
Target
deiUUj8mpdyf36k.exe
-
Size
691KB
-
MD5
4c2978004f201c8a9d8f86ba5a00be29
-
SHA1
06610092027ca2632d771a228d36358b77c8bd65
-
SHA256
43756195653d9b20db70b3b2700d6ece0e927da322db216d12e6eeb6af316f3f
-
SHA512
bf5328040efaafce37bc3df6a3ec4979857b34a7f83763ee333e0ee583efdc8d7b7d7d80f6ffa21aa25f22585f2d89c07e24dc9b2140fd73f4d070d33ee630ec
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
deiUUj8mpdyf36k.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion deiUUj8mpdyf36k.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion deiUUj8mpdyf36k.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
deiUUj8mpdyf36k.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation deiUUj8mpdyf36k.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
deiUUj8mpdyf36k.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 deiUUj8mpdyf36k.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum deiUUj8mpdyf36k.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
deiUUj8mpdyf36k.exedescription pid process target process PID 2092 set thread context of 4644 2092 deiUUj8mpdyf36k.exe deiUUj8mpdyf36k.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
deiUUj8mpdyf36k.exepowershell.exepid process 2092 deiUUj8mpdyf36k.exe 2384 powershell.exe 2384 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
deiUUj8mpdyf36k.exepowershell.exedescription pid process Token: SeDebugPrivilege 2092 deiUUj8mpdyf36k.exe Token: SeDebugPrivilege 2384 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
deiUUj8mpdyf36k.exedeiUUj8mpdyf36k.execmd.exedescription pid process target process PID 2092 wrote to memory of 616 2092 deiUUj8mpdyf36k.exe schtasks.exe PID 2092 wrote to memory of 616 2092 deiUUj8mpdyf36k.exe schtasks.exe PID 2092 wrote to memory of 616 2092 deiUUj8mpdyf36k.exe schtasks.exe PID 2092 wrote to memory of 4644 2092 deiUUj8mpdyf36k.exe deiUUj8mpdyf36k.exe PID 2092 wrote to memory of 4644 2092 deiUUj8mpdyf36k.exe deiUUj8mpdyf36k.exe PID 2092 wrote to memory of 4644 2092 deiUUj8mpdyf36k.exe deiUUj8mpdyf36k.exe PID 2092 wrote to memory of 4644 2092 deiUUj8mpdyf36k.exe deiUUj8mpdyf36k.exe PID 2092 wrote to memory of 4644 2092 deiUUj8mpdyf36k.exe deiUUj8mpdyf36k.exe PID 2092 wrote to memory of 4644 2092 deiUUj8mpdyf36k.exe deiUUj8mpdyf36k.exe PID 2092 wrote to memory of 4644 2092 deiUUj8mpdyf36k.exe deiUUj8mpdyf36k.exe PID 2092 wrote to memory of 4644 2092 deiUUj8mpdyf36k.exe deiUUj8mpdyf36k.exe PID 4644 wrote to memory of 5104 4644 deiUUj8mpdyf36k.exe cmd.exe PID 4644 wrote to memory of 5104 4644 deiUUj8mpdyf36k.exe cmd.exe PID 4644 wrote to memory of 5104 4644 deiUUj8mpdyf36k.exe cmd.exe PID 5104 wrote to memory of 2384 5104 cmd.exe powershell.exe PID 5104 wrote to memory of 2384 5104 cmd.exe powershell.exe PID 5104 wrote to memory of 2384 5104 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\deiUUj8mpdyf36k.exe"C:\Users\Admin\AppData\Local\Temp\deiUUj8mpdyf36k.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WxXWXfzHXGJW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp78D9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\deiUUj8mpdyf36k.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\deiUUj8mpdyf36k.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\deiUUj8mpdyf36k.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\deiUUj8mpdyf36k.exe.logFilesize
599B
MD5a56b1681d95f33a909d6f34c33f706fb
SHA1e996e63f53e9041910f84a4246085c7e76d8ea37
SHA2567d87bc567d369a8c708b33966c428845d44ce433d2a6445ca4ccf6449482b3a7
SHA512f0d7998ccb520c7229f95ed26a714b07e6a87c16d097546751f7a0f61678b0abb3fbfcc0caa8eba66fa19c09ad659f89475f0f071f3b249bd1bee07a7cd665a2
-
C:\Users\Admin\AppData\Local\Temp\tmp78D9.tmpFilesize
1KB
MD5ecc978893a075d53cdf0118cd3a0d975
SHA13ba707502e5ff9a94da1232cec76091e9408c9d8
SHA2563d3aaec0f4172bf968fb176061db5b99757457fefc5eaea1a7d927237b18026c
SHA5126c9404665ba2d2aa59e0ea842e9537d5cc0889cb5add7e6831ed3f7a56ad588d2fc0af6efdc158acf89902ab20029db313d427ca12d94553308eee8be003d9a4
-
memory/616-135-0x0000000000000000-mapping.dmp
-
memory/2092-131-0x00000000053B0000-0x0000000005954000-memory.dmpFilesize
5.6MB
-
memory/2092-132-0x0000000004D30000-0x0000000004DC2000-memory.dmpFilesize
584KB
-
memory/2092-133-0x0000000005C40000-0x0000000005CDC000-memory.dmpFilesize
624KB
-
memory/2092-134-0x0000000005D50000-0x0000000005DB6000-memory.dmpFilesize
408KB
-
memory/2092-130-0x00000000002D0000-0x0000000000384000-memory.dmpFilesize
720KB
-
memory/2384-145-0x0000000004E20000-0x0000000004E86000-memory.dmpFilesize
408KB
-
memory/2384-141-0x0000000000000000-mapping.dmp
-
memory/2384-142-0x0000000000E90000-0x0000000000EC6000-memory.dmpFilesize
216KB
-
memory/2384-143-0x0000000004EF0000-0x0000000005518000-memory.dmpFilesize
6.2MB
-
memory/2384-144-0x0000000004D80000-0x0000000004DA2000-memory.dmpFilesize
136KB
-
memory/2384-146-0x0000000005C30000-0x0000000005C4E000-memory.dmpFilesize
120KB
-
memory/2384-147-0x00000000074B0000-0x0000000007B2A000-memory.dmpFilesize
6.5MB
-
memory/2384-148-0x0000000006110000-0x000000000612A000-memory.dmpFilesize
104KB
-
memory/2384-149-0x0000000006ED0000-0x0000000006F66000-memory.dmpFilesize
600KB
-
memory/2384-150-0x00000000061F0000-0x0000000006212000-memory.dmpFilesize
136KB
-
memory/4644-138-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/4644-137-0x0000000000000000-mapping.dmp
-
memory/5104-140-0x0000000000000000-mapping.dmp