Analysis
-
max time kernel
91s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-06-2022 17:54
Static task
static1
Behavioral task
behavioral1
Sample
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe
Resource
win10v2004-20220414-en
General
-
Target
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe
-
Size
142KB
-
MD5
b7920415a12a7db60121cecf1682c1bd
-
SHA1
d2c4bc48ae40d0479020bc91f8135d14d0deca57
-
SHA256
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808
-
SHA512
1a8930fc137a61decef7a2e3df3e6b477309278a6dae5b14b83d565873456d9987a57613bfa0c3a7a6bc05341207a376b0ffce344cf29db12f3aa385f6635de1
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe -
Drops file in System32 directory 2 IoCs
Processes:
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exedescription ioc process File created C:\Windows\SysWOW64\dllcache\vvvhost.exe 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe File opened for modification C:\Windows\SysWOW64\dllcache\vvvhost.exe 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
Processes:
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exedescription pid process target process PID 3948 wrote to memory of 1708 3948 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe cmd.exe PID 3948 wrote to memory of 1708 3948 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe cmd.exe PID 3948 wrote to memory of 1708 3948 31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe"C:\Users\Admin\AppData\Local\Temp\31ce0d989e9f3e077c9bfc6860aed53986e32826b383cdaa4122780d7c04f808.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\31CE0D~1.EXE >> NUL2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1708-132-0x0000000000000000-mapping.dmp
-
memory/3948-130-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/3948-131-0x0000000000A40000-0x0000000000A70000-memory.dmpFilesize
192KB
-
memory/3948-133-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB