Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 01:41
Static task
static1
Behavioral task
behavioral1
Sample
ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.exe
Resource
win7-20220414-en
General
-
Target
ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.exe
-
Size
1.9MB
-
MD5
f0faa31e557acb4d73a8351ee80b6a3e
-
SHA1
ba4f77d0b7803df4fca1d9b797dbc09b18c6501c
-
SHA256
ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841
-
SHA512
afa4c1aaa236d61f5567decd1333c4b120e0b3265f2ce42d22197e30aa6ee11468e68ab6b0e2178809c4331850fa6ee0571ea86bb1315e8e3c92abc8dbc882fc
Malware Config
Extracted
socelars
http://www.createinfo.pw/
http://www.allinfo.pw/
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmpDiskScan.exepid process 3204 ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp 4204 DiskScan.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\pdfreader2010\DiskScan.exe upx C:\Users\Admin\AppData\Local\Temp\pdfreader2010\DiskScan.exe upx behavioral2/memory/4204-139-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmpdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1244 4204 WerFault.exe DiskScan.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmppid process 3204 ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp 3204 ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmppid process 3204 ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.exeef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmpdescription pid process target process PID 3436 wrote to memory of 3204 3436 ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.exe ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp PID 3436 wrote to memory of 3204 3436 ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.exe ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp PID 3436 wrote to memory of 3204 3436 ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.exe ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp PID 3204 wrote to memory of 4204 3204 ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp DiskScan.exe PID 3204 wrote to memory of 4204 3204 ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp DiskScan.exe PID 3204 wrote to memory of 4204 3204 ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp DiskScan.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.exe"C:\Users\Admin\AppData\Local\Temp\ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-77EOC.tmp\ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp"C:\Users\Admin\AppData\Local\Temp\is-77EOC.tmp\ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmp" /SL5="$80028,1302756,816640,C:\Users\Admin\AppData\Local\Temp\ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pdfreader2010\DiskScan.exe"C:\Users\Admin\AppData\Local\Temp\pdfreader2010\DiskScan.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 11444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4204 -ip 42041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-77EOC.tmp\ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmpFilesize
2.5MB
MD5066108c4b0102357ebdaf3791ba38fe8
SHA159e9e8043232169c0554e350c233433b0bc4c83c
SHA256a720dd6efcd1910ea490c0095ff0efa36eb5228712e61294eeb4b3072715c035
SHA512a2bb074f042d7214536083dfe341da9dafe1d170cf52e9c0f4ff0041f959d4a28cc6be9cb0e5ec3adf63188d658332b7440d6b5ac8e02af2801e7f34a04acad2
-
C:\Users\Admin\AppData\Local\Temp\is-77EOC.tmp\ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841.tmpFilesize
2.5MB
MD5066108c4b0102357ebdaf3791ba38fe8
SHA159e9e8043232169c0554e350c233433b0bc4c83c
SHA256a720dd6efcd1910ea490c0095ff0efa36eb5228712e61294eeb4b3072715c035
SHA512a2bb074f042d7214536083dfe341da9dafe1d170cf52e9c0f4ff0041f959d4a28cc6be9cb0e5ec3adf63188d658332b7440d6b5ac8e02af2801e7f34a04acad2
-
C:\Users\Admin\AppData\Local\Temp\pdfreader2010\DiskScan.exeFilesize
569KB
MD555307d9adfbcc76551eb24aa2f650dd4
SHA186bbbaa938d4a1f0077d30b661c0cfac40a079ff
SHA256a65dcf1408ac9eab201fabf115df1dbe1516a713552e9ef58e0cacef7e05a97e
SHA51235463548786681d53813b4b869e62a900f92e2f129afa8011a2260baaf5a76c6d27d2390d8a9be4fdea8d5d80ff3aafaafc87694c8751a8a551081768f939b57
-
C:\Users\Admin\AppData\Local\Temp\pdfreader2010\DiskScan.exeFilesize
569KB
MD555307d9adfbcc76551eb24aa2f650dd4
SHA186bbbaa938d4a1f0077d30b661c0cfac40a079ff
SHA256a65dcf1408ac9eab201fabf115df1dbe1516a713552e9ef58e0cacef7e05a97e
SHA51235463548786681d53813b4b869e62a900f92e2f129afa8011a2260baaf5a76c6d27d2390d8a9be4fdea8d5d80ff3aafaafc87694c8751a8a551081768f939b57
-
memory/3204-133-0x0000000000000000-mapping.dmp
-
memory/3436-130-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/3436-132-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/3436-140-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/4204-136-0x0000000000000000-mapping.dmp
-
memory/4204-139-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB