264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

General

Target

264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe
Size

1.0MB
MD5

c0b375a5c4bcfc0a08699ad368de0b67
SHA1

644ec97218b4b0b41e560a1e8f57221de1b3fbf5
SHA256

264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2
SHA512

bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2364	ScreenRotate.exe
2544	ScreenRotate.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	ScreenRotate.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenRotate.lnk	ScreenRotate.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2364 set thread context of 2544	2364	ScreenRotate.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe\:Zone.Identifier:$DATA	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe
Token: SeDebugPrivilege	2364	ScreenRotate.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 2952	4628	264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe	84
PID 4628 wrote to memory of 2952	4628	264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe	84
PID 4628 wrote to memory of 2952	4628	264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe	84
PID 4628 wrote to memory of 4764	4628	264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe	86
PID 4628 wrote to memory of 4764	4628	264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe	86
PID 4628 wrote to memory of 4764	4628	264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe	86
PID 4628 wrote to memory of 2312	4628	264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe	88
PID 4628 wrote to memory of 2312	4628	264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe	88
PID 4628 wrote to memory of 2312	4628	264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe	88
PID 2312 wrote to memory of 2364	2312	cmd.exe	90
PID 2312 wrote to memory of 2364	2312	cmd.exe	90
PID 2312 wrote to memory of 2364	2312	cmd.exe	90
PID 2364 wrote to memory of 3036	2364	ScreenRotate.exe	91
PID 2364 wrote to memory of 3036	2364	ScreenRotate.exe	91
PID 2364 wrote to memory of 3036	2364	ScreenRotate.exe	91
PID 2364 wrote to memory of 2544	2364	ScreenRotate.exe	93
PID 2364 wrote to memory of 2544	2364	ScreenRotate.exe	93
PID 2364 wrote to memory of 2544	2364	ScreenRotate.exe	93
PID 2364 wrote to memory of 2544	2364	ScreenRotate.exe	93
PID 2364 wrote to memory of 2544	2364	ScreenRotate.exe	93
PID 2364 wrote to memory of 2544	2364	ScreenRotate.exe	93
PID 2364 wrote to memory of 2544	2364	ScreenRotate.exe	93
PID 2364 wrote to memory of 2544	2364	ScreenRotate.exe	93

C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe
"C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe:Zone.Identifier"
  2⤵
  - NTFS ADS
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe"
  2⤵
  - NTFS ADS
  PID:4764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Drops startup file
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe:Zone.Identifier"
      4⤵
      NTFS ADS
      PID:3036
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
      C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe
      4⤵
      Executes dropped EXE
      PID:2544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe

Filesize
1.0MB

MD5
c0b375a5c4bcfc0a08699ad368de0b67

SHA1
644ec97218b4b0b41e560a1e8f57221de1b3fbf5

SHA256
264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

SHA512
bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe

Filesize
1.0MB

MD5
c0b375a5c4bcfc0a08699ad368de0b67

SHA1
644ec97218b4b0b41e560a1e8f57221de1b3fbf5

SHA256
264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

SHA512
bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\ScreenRotate.exe

Filesize
1.0MB

MD5
c0b375a5c4bcfc0a08699ad368de0b67

SHA1
644ec97218b4b0b41e560a1e8f57221de1b3fbf5

SHA256
264e72b1322193ffd3eb1185dc67a87661962835e3beebd6250a3b3bc1b6e4d2

SHA512
bb465698545e59b3d2d294e23f3535b7408a42c488005917f161964b161cd0ddc7729605b03dee7b5699f3a7c9a166d579a842de357eff76c7236c18d637006c

Download Submit
memory/2364-144-0x0000000007470000-0x000000000750C000-memory.dmp

Filesize
624KB

Download
memory/2544-146-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4628-134-0x0000000005040000-0x0000000005062000-memory.dmp

Filesize
136KB

Download
memory/4628-137-0x0000000006330000-0x00000000068D4000-memory.dmp

Filesize
5.6MB

Download
memory/4628-135-0x0000000005390000-0x0000000005552000-memory.dmp

Filesize
1.8MB

Download
memory/4628-130-0x00000000005C0000-0x00000000006D2000-memory.dmp

Filesize
1.1MB

Download
memory/4628-133-0x0000000005150000-0x00000000051B6000-memory.dmp

Filesize
408KB

Download
memory/4628-132-0x00000000050B0000-0x0000000005142000-memory.dmp

Filesize
584KB

Download
memory/4628-131-0x0000000004FE0000-0x0000000005002000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing