Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-06-2022 04:20
Static task
static1
Behavioral task
behavioral1
Sample
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe
Resource
win10v2004-20220414-en
General
-
Target
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe
-
Size
212KB
-
MD5
0c4a0a1d43bc8a7c69fa423ea2923a9f
-
SHA1
fb2b154989c6fb8b6a9d9b10eb59999f5e84ce8d
-
SHA256
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9
-
SHA512
d7060323e4a1e1366a367573a387caba66a7eb3a95b9a305461d27043beb634c101e70dda6d61b47b54e751582cb80f843b4ecaeaeca8382a3d605dca52b418b
Malware Config
Extracted
tofsee
103.232.222.57
111.121.193.242
123.249.0.22
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
chgjaost.exepid process 1652 chgjaost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\chgjaost.exe\"" 22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
chgjaost.exedescription pid process target process PID 1652 set thread context of 1880 1652 chgjaost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4516 1880 WerFault.exe svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exechgjaost.exepid process 2912 22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe 1652 chgjaost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exechgjaost.exedescription pid process target process PID 2912 wrote to memory of 1652 2912 22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe chgjaost.exe PID 2912 wrote to memory of 1652 2912 22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe chgjaost.exe PID 2912 wrote to memory of 1652 2912 22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe chgjaost.exe PID 2912 wrote to memory of 2404 2912 22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe cmd.exe PID 2912 wrote to memory of 2404 2912 22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe cmd.exe PID 2912 wrote to memory of 2404 2912 22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe cmd.exe PID 1652 wrote to memory of 1880 1652 chgjaost.exe svchost.exe PID 1652 wrote to memory of 1880 1652 chgjaost.exe svchost.exe PID 1652 wrote to memory of 1880 1652 chgjaost.exe svchost.exe PID 1652 wrote to memory of 1880 1652 chgjaost.exe svchost.exe PID 1652 wrote to memory of 1880 1652 chgjaost.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe"C:\Users\Admin\AppData\Local\Temp\22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\chgjaost.exe"C:\Users\Admin\chgjaost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 4684⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2803.bat" "2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1880 -ip 18801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2803.batFilesize
302B
MD573b48ef223cdd7cf4dbfeecb297b98e0
SHA1d56e3be333b160b61e454e7ab6cc33a78d5800f3
SHA256908a08074d991f8c7614abf11e0258155e3f19170cf57739ed9b2da09fa4153f
SHA512067ede719f7ba787eda910df199d74954ca5807f1d551d85bf45bc47b1070128af24f5101333637cc9fe3ecf3b479c9bd2ce10f2ac7b2c5a52d4f82c1103e659
-
C:\Users\Admin\chgjaost.exeFilesize
38.2MB
MD5caa3ab683d352336d3243559968b7371
SHA1e669ab8cdb359b1c3207e83772e93c89d2b04966
SHA2564484a7d16f70e4bcbf42143e93ea49f09a9426afe28b1a3b0a6345bcff350ad8
SHA512fe32bf3b3a166daae222dcf6d3fb995e75a5f13ecb0b28de78c7df0ee7304a2291ce1f5ff36623891ee87f7e3f76e442a29a7b375e6a22d9e18d63678a5b28b0
-
C:\Users\Admin\chgjaost.exeFilesize
38.2MB
MD5caa3ab683d352336d3243559968b7371
SHA1e669ab8cdb359b1c3207e83772e93c89d2b04966
SHA2564484a7d16f70e4bcbf42143e93ea49f09a9426afe28b1a3b0a6345bcff350ad8
SHA512fe32bf3b3a166daae222dcf6d3fb995e75a5f13ecb0b28de78c7df0ee7304a2291ce1f5ff36623891ee87f7e3f76e442a29a7b375e6a22d9e18d63678a5b28b0
-
memory/1652-146-0x0000000002D11000-0x0000000002D16000-memory.dmpFilesize
20KB
-
memory/1652-157-0x0000000074C00000-0x0000000074D5D000-memory.dmpFilesize
1.4MB
-
memory/1652-138-0x0000000000000000-mapping.dmp
-
memory/1880-154-0x0000000000430000-0x0000000000442000-memory.dmpFilesize
72KB
-
memory/1880-153-0x0000000000000000-mapping.dmp
-
memory/1880-158-0x0000000000430000-0x0000000000442000-memory.dmpFilesize
72KB
-
memory/1880-159-0x0000000000430000-0x0000000000442000-memory.dmpFilesize
72KB
-
memory/2404-144-0x0000000000000000-mapping.dmp
-
memory/2912-145-0x0000000074C00000-0x0000000074D5D000-memory.dmpFilesize
1.4MB
-
memory/2912-134-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2912-143-0x0000000074C00000-0x0000000074D5D000-memory.dmpFilesize
1.4MB
-
memory/2912-132-0x0000000002BF1000-0x0000000002BF6000-memory.dmpFilesize
20KB