Resubmissions
14-06-2022 13:46
220614-q27ymaeddr 1014-06-2022 13:36
220614-qwnmssadd4 314-06-2022 09:14
220614-k7h9kahcb9 1012-06-2022 12:43
220612-pxv8lacabn 701-06-2022 16:27
220601-tyedpaeahk 10Analysis
-
max time kernel
237s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-06-2022 12:43
Static task
static1
Behavioral task
behavioral1
Sample
zxcvb.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
zxcvb.exe
-
Size
40KB
-
MD5
0a7b32e75a01764ef5389a1d9e72ed63
-
SHA1
871366f3573c3349e9dc7b67fef1ef575815c154
-
SHA256
34ba222ef969f09ecca5506cbada7c346469a96a6af0cdd21146d4435196deda
-
SHA512
f19a7d56a825b59d2841a4f10db940458d3255239e15bb9bbe1376e1fc47d4c97aef09d4e7ecd5a3a35fca44ec92edf60edd4a07ef1845d679c3bd4fc8fe43ba
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation zxcvb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2884 3096 WerFault.exe 24 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3788 timeout.exe -
Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1096 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3096 zxcvb.exe Token: SeDebugPrivilege 1096 taskmgr.exe Token: SeSystemProfilePrivilege 1096 taskmgr.exe Token: SeCreateGlobalPrivilege 1096 taskmgr.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe -
Suspicious use of SendNotifyMessage 53 IoCs
pid Process 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe 1096 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3096 wrote to memory of 3236 3096 zxcvb.exe 78 PID 3096 wrote to memory of 3236 3096 zxcvb.exe 78 PID 3096 wrote to memory of 3236 3096 zxcvb.exe 78 PID 3236 wrote to memory of 3788 3236 cmd.exe 80 PID 3236 wrote to memory of 3788 3236 cmd.exe 80 PID 3236 wrote to memory of 3788 3236 cmd.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 202⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\timeout.exetimeout /t 203⤵
- Delays execution with timeout.exe
PID:3788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 17362⤵
- Program crash
PID:2884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3096 -ip 30961⤵PID:1908
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1096