Overview

overview

10

Static

static

mine2.exe

windows7_x64

10

mine2.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    192s
  • max time network
    210s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    22-05-2022 05:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    mine2.exe

  • Size

    810KB

  • MD5

    be75e9e51767b5a59536afbbf9ffafbc

  • SHA1

    78be65d86a6918643092e8e90fd72ad3b9ab997f

  • SHA256

    30a4788b9d7eb3c50403737f4af3882b79ba75b8201d53aefb359336f5763745

  • SHA512

    4e9f7198dd12adeb21669f74e1cdebe16ac7ccae8e1f29b537438239d1a240a8f1ab890afebe8c1f8603909a1c72b8ce7e7c981f2147fa53dccc6c43b6a3d9e6

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mine2.exe
    "C:\Users\Admin\AppData\Local\Temp\mine2.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4716
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /create /tn HGRAyZk0Y950ZeEUrPGcT36so /tr "C:\ProgramData\test\test.exe" /st 07:50 /du 23:59 /sc daily /ri 1 /f
      2⤵
      • Creates scheduled task(s)
      PID:364
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD9A2.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3420
      • C:\Windows\system32\timeout.exe
        timeout 6
        3⤵
        • Delays execution with timeout.exe
        PID:3512
    • C:\ProgramData\test\test.exe
      "C:\ProgramData\test\test.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      PID:920

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\test\test.exe
    Filesize

    185.2MB

    MD5

    2bd057142ff3f119f4169c13d7c0f241

    SHA1

    fb23bc4bde2012a89889874d83ea476800d8de66

    SHA256

    46304faee562f2c1dae91ce6da25524655c29b85dc07cc705497d6e684a9a057

    SHA512

    bb0c0d303827bd81e28d4cba409f7d5e355106969960af2da2d04335fbcde2ac4f784eb64735675097c7558f9594b97b6ec22c0ec7eabff92eab209ad7a9a851

    Download Submit

  • C:\ProgramData\test\test.exe
    Filesize

    185.4MB

    MD5

    0252aae9c27e74b50f413df7fe894bb7

    SHA1

    1a8738044263d063e1c7544728867d3e4d94ffdc

    SHA256

    5ec57245e53c65ae97cff2e4a6d43e26eb5195104ee23d81746c9fd9d8e060c2

    SHA512

    351ebcc787ca0ff52ed78c57e483c2a733c1845776cc6a1a3e95b1be96c85a682b464a4316671011a30952bec04ef7452813dadfe45f2d649071e08cfc749c4e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpD9A2.tmp.bat
    Filesize

    157B

    MD5

    f9d4743117facef100a4eae95ad9149d

    SHA1

    b96b0aa7755ce8e6e6c0b36c8391c9321061b0c7

    SHA256

    a8f1c08a7e2340b24b9d10275fe9ecd37c83ffb7de30da6040accc62c65f568a

    SHA512

    1d6878f166a1cc38b6eb748932c838f69ea355c3b88d6c0640f8da4d5940c727b8264a2caac5c5a74d5386e28725b2e4928d97b71b46183550cc5b0fd13d2b9e

    Download Submit

  • memory/920-138-0x00007FFC1D2D0000-0x00007FFC1DD91000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/920-141-0x000000001C389000-0x000000001C38F000-memory.dmp

    Filesize

    24KB

    Download

  • memory/4716-131-0x0000000000700000-0x00000000007CE000-memory.dmp

    Filesize

    824KB

    Download

  • memory/4716-132-0x00007FFC1D2D0000-0x00007FFC1DD91000-memory.dmp

    Filesize

    10.8MB

    Download