Resubmissions

12-06-2022 22:27

220612-2c3s6adgd5 10

10-06-2022 17:29

220610-v2jm9adfel 8

Analysis

  • max time kernel
    106s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    10-06-2022 17:29

General

  • Target

    State-Farm-Auto-Insurance-Policy-Booklet.exe

  • Size

    266.0MB

  • MD5

    3a015f8d7013c0fef3322e08cd41b565

  • SHA1

    b4d03c21ff99aceb0023ec581e953b17ad541580

  • SHA256

    29014a3438c174c2e7377168adf62080e7566e1664c1b639e454a9ad961b5fde

  • SHA512

    f97e2b80eb0b00351c406df2a455d3dfe214925aada81455c5d40924a613ef883119a365978b50882a35fb27635c5937af0da7a8a5f91074eefa6eaba10518bf

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\State-Farm-Auto-Insurance-Policy-Booklet.exe
    "C:\Users\Admin\AppData\Local\Temp\State-Farm-Auto-Insurance-Policy-Booklet.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3800
    • C:\Users\Admin\AppData\Local\Temp\Plevin.exe
      "C:\Users\Admin\AppData\Local\Temp\Plevin.exe"
      2⤵
      • Executes dropped EXE
      PID:4244
    • C:\Users\Admin\AppData\Local\Temp\State-Farm-Auto-Insurance-Policy-Booklet.exe
      "C:\Users\Admin\AppData\Local\Temp\State-Farm-Auto-Insurance-Policy-Booklet.exe" /s
      2⤵
      • Drops startup file
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:544

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\State-Farm-Auto-Insurance-Policy-Booklet.exe.log

    Filesize

    425B

    MD5

    fff5cbccb6b31b40f834b8f4778a779a

    SHA1

    899ed0377e89f1ed434cfeecc5bc0163ebdf0454

    SHA256

    b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76

    SHA512

    1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

  • C:\Users\Admin\AppData\Local\Temp\Plevin.exe

    Filesize

    997KB

    MD5

    dbc534854dd385e59a3f1906ddfb9020

    SHA1

    2b3062d82232ce10a8713829199769ff0d12e0fc

    SHA256

    06486febb76aaa7bf469ba1bf46a92c4eafc42a5626646184e8865c862d09dd0

    SHA512

    1506fbc8fca0a3ca06e24fdae2fb9e8cb345fd6197f5cbbaa990490cc20a25b72906ab9668725f29c0bfce6528bd7dca5dc15ca0ac3c0327d1876e58e3d47951

  • C:\Users\Admin\AppData\Local\Temp\Plevin.exe

    Filesize

    997KB

    MD5

    dbc534854dd385e59a3f1906ddfb9020

    SHA1

    2b3062d82232ce10a8713829199769ff0d12e0fc

    SHA256

    06486febb76aaa7bf469ba1bf46a92c4eafc42a5626646184e8865c862d09dd0

    SHA512

    1506fbc8fca0a3ca06e24fdae2fb9e8cb345fd6197f5cbbaa990490cc20a25b72906ab9668725f29c0bfce6528bd7dca5dc15ca0ac3c0327d1876e58e3d47951

  • memory/544-135-0x0000000000000000-mapping.dmp

  • memory/544-139-0x00007FFE12440000-0x00007FFE12F01000-memory.dmp

    Filesize

    10.8MB

  • memory/544-140-0x00007FFE12440000-0x00007FFE12F01000-memory.dmp

    Filesize

    10.8MB

  • memory/544-141-0x000001B670240000-0x000001B670262000-memory.dmp

    Filesize

    136KB

  • memory/3800-130-0x000001B4CEDC0000-0x000001B4CF054000-memory.dmp

    Filesize

    2.6MB

  • memory/3800-131-0x00007FFE12440000-0x00007FFE12F01000-memory.dmp

    Filesize

    10.8MB

  • memory/3800-132-0x00007FFE12440000-0x00007FFE12F01000-memory.dmp

    Filesize

    10.8MB

  • memory/3800-138-0x00007FFE12440000-0x00007FFE12F01000-memory.dmp

    Filesize

    10.8MB

  • memory/4244-133-0x0000000000000000-mapping.dmp