Analysis
-
max time kernel
156s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 04:12
Static task
static1
Behavioral task
behavioral1
Sample
5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe
Resource
win10v2004-20220414-en
General
-
Target
5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe
-
Size
140KB
-
MD5
8f3b91fab3b43f4ab87c0b0a313a21c5
-
SHA1
4a7108276f093be0336f7f457f5973b86a0ad587
-
SHA256
5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac
-
SHA512
15c369e28128f796de46d7efa88c50ff32ebc58beaa3c62d935c9f2f690ffbcf17381d894c95653947c895a54bc849c995d282e1ed32d4a703c3d9333041337f
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exedescription pid process target process PID 1312 set thread context of 1176 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exepid process 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe Token: SeDebugPrivilege 1176 MSBuild.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exedescription pid process target process PID 1312 wrote to memory of 4284 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe schtasks.exe PID 1312 wrote to memory of 4284 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe schtasks.exe PID 1312 wrote to memory of 4284 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe schtasks.exe PID 1312 wrote to memory of 1560 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe PID 1312 wrote to memory of 1560 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe PID 1312 wrote to memory of 1560 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe PID 1312 wrote to memory of 1176 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe PID 1312 wrote to memory of 1176 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe PID 1312 wrote to memory of 1176 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe PID 1312 wrote to memory of 1176 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe PID 1312 wrote to memory of 1176 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe PID 1312 wrote to memory of 1176 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe PID 1312 wrote to memory of 1176 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe PID 1312 wrote to memory of 1176 1312 5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe"C:\Users\Admin\AppData\Local\Temp\5ef82b40d2f8ba80a91f4c518a457ad003cf4c44343696f4af2396626b8fcaac.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VILDCWsxo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC44.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC44.tmpFilesize
1KB
MD50989fc445c80f68e635fb54f46045a5c
SHA15b37b8357490aba98bcb14104227e55c1ebef10f
SHA256d2a77495d54e3199ae3dd7d7e09f2cd0a57a74105c4ef83ad660d29ac2a041bd
SHA5124ff1bfe3e5e48079bce32cdf2f071fdd435cac1746f9c0ff92a6d93bcc35960cb0c09cdf14cc4d22b7f0816a30c8ef6804e6c5f3ee173e7ae67deb36c8495a6b
-
memory/1176-138-0x0000000000000000-mapping.dmp
-
memory/1176-139-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/1312-130-0x0000000000130000-0x000000000015A000-memory.dmpFilesize
168KB
-
memory/1312-131-0x0000000005130000-0x00000000056D4000-memory.dmpFilesize
5.6MB
-
memory/1312-132-0x0000000004B80000-0x0000000004C12000-memory.dmpFilesize
584KB
-
memory/1312-133-0x0000000004B10000-0x0000000004B1A000-memory.dmpFilesize
40KB
-
memory/1312-134-0x00000000071C0000-0x000000000725C000-memory.dmpFilesize
624KB
-
memory/1560-137-0x0000000000000000-mapping.dmp
-
memory/4284-135-0x0000000000000000-mapping.dmp