Analysis
-
max time kernel
92s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26-06-2022 02:14
Static task
static1
Behavioral task
behavioral1
Sample
368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe
Resource
win10v2004-20220414-en
General
-
Target
368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe
-
Size
723KB
-
MD5
c9a560b2721b47ca68d577115cfa9d14
-
SHA1
df85d6c4624325425470ca3f95b18e89598d117d
-
SHA256
368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa
-
SHA512
98c1e19d9625bcf4ffe6044a5ea6066708528b15c4546c05d2403385e1a54a9360b609bcb214e400c72d21cd1266f56c1cb33fbe144186dd3bc34e7f40d7441c
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
project4992.exepid process 4632 project4992.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exeproject4992.exedescription pid process Token: SeDebugPrivilege 3296 368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe Token: SeDebugPrivilege 4632 project4992.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.execmd.exedescription pid process target process PID 3296 wrote to memory of 372 3296 368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe cmd.exe PID 3296 wrote to memory of 372 3296 368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe cmd.exe PID 3296 wrote to memory of 372 3296 368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe cmd.exe PID 3296 wrote to memory of 3804 3296 368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe cmd.exe PID 3296 wrote to memory of 3804 3296 368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe cmd.exe PID 3296 wrote to memory of 3804 3296 368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe cmd.exe PID 3804 wrote to memory of 4632 3804 cmd.exe project4992.exe PID 3804 wrote to memory of 4632 3804 cmd.exe project4992.exe PID 3804 wrote to memory of 4632 3804 cmd.exe project4992.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe"C:\Users\Admin\AppData\Local\Temp\368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa.exe" "C:\Users\Admin\Documents\project4992.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Documents\project4992.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\project4992.exe"C:\Users\Admin\Documents\project4992.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\project4992.exeFilesize
723KB
MD5c9a560b2721b47ca68d577115cfa9d14
SHA1df85d6c4624325425470ca3f95b18e89598d117d
SHA256368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa
SHA51298c1e19d9625bcf4ffe6044a5ea6066708528b15c4546c05d2403385e1a54a9360b609bcb214e400c72d21cd1266f56c1cb33fbe144186dd3bc34e7f40d7441c
-
C:\Users\Admin\Documents\project4992.exeFilesize
723KB
MD5c9a560b2721b47ca68d577115cfa9d14
SHA1df85d6c4624325425470ca3f95b18e89598d117d
SHA256368879602c1cbd9aba693fe681b5b3972d033c7ad782c324965f569986ef64aa
SHA51298c1e19d9625bcf4ffe6044a5ea6066708528b15c4546c05d2403385e1a54a9360b609bcb214e400c72d21cd1266f56c1cb33fbe144186dd3bc34e7f40d7441c
-
memory/372-133-0x0000000000000000-mapping.dmp
-
memory/3296-130-0x0000000000B00000-0x0000000000BBE000-memory.dmpFilesize
760KB
-
memory/3296-131-0x0000000005C50000-0x00000000061F4000-memory.dmpFilesize
5.6MB
-
memory/3296-132-0x0000000005580000-0x0000000005612000-memory.dmpFilesize
584KB
-
memory/3804-134-0x0000000000000000-mapping.dmp
-
memory/4632-135-0x0000000000000000-mapping.dmp