Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-07-2022 05:01
Static task
static1
Behavioral task
behavioral1
Sample
8abebde631005ae15aba91eb8f36fbe7.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
8abebde631005ae15aba91eb8f36fbe7.exe
-
Size
983KB
-
MD5
8abebde631005ae15aba91eb8f36fbe7
-
SHA1
d4ac00d9aee072b6d1499e730cf9bcb27ad957ad
-
SHA256
2e66e23d1ae80b56efc2c38bf5adbb31dab91b811eaadce68f544e06323d52ef
-
SHA512
7091584d35154b0711e4a8b6c788cc5db5ad0e6444e5cda5a16ad41a00cf333413fc8ac5b93e84b9b2e5e9350ca89837c6f69b5838ade967b403bd24322ab3fc
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 8abebde631005ae15aba91eb8f36fbe7.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 8abebde631005ae15aba91eb8f36fbe7.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2000 set thread context of 1356 2000 8abebde631005ae15aba91eb8f36fbe7.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4320 2000 WerFault.exe 78 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2268 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1620 powershell.exe 1356 8abebde631005ae15aba91eb8f36fbe7.exe 1620 powershell.exe 1356 8abebde631005ae15aba91eb8f36fbe7.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 1356 8abebde631005ae15aba91eb8f36fbe7.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 1356 8abebde631005ae15aba91eb8f36fbe7.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1356 8abebde631005ae15aba91eb8f36fbe7.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1620 powershell.exe Token: SeDebugPrivilege 1356 8abebde631005ae15aba91eb8f36fbe7.exe Token: SeDebugPrivilege 2664 Taskmgr.exe Token: SeSystemProfilePrivilege 2664 Taskmgr.exe Token: SeCreateGlobalPrivilege 2664 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe 2664 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1356 8abebde631005ae15aba91eb8f36fbe7.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1620 2000 8abebde631005ae15aba91eb8f36fbe7.exe 82 PID 2000 wrote to memory of 1620 2000 8abebde631005ae15aba91eb8f36fbe7.exe 82 PID 2000 wrote to memory of 1620 2000 8abebde631005ae15aba91eb8f36fbe7.exe 82 PID 2000 wrote to memory of 2268 2000 8abebde631005ae15aba91eb8f36fbe7.exe 84 PID 2000 wrote to memory of 2268 2000 8abebde631005ae15aba91eb8f36fbe7.exe 84 PID 2000 wrote to memory of 2268 2000 8abebde631005ae15aba91eb8f36fbe7.exe 84 PID 2000 wrote to memory of 1356 2000 8abebde631005ae15aba91eb8f36fbe7.exe 86 PID 2000 wrote to memory of 1356 2000 8abebde631005ae15aba91eb8f36fbe7.exe 86 PID 2000 wrote to memory of 1356 2000 8abebde631005ae15aba91eb8f36fbe7.exe 86 PID 2000 wrote to memory of 1356 2000 8abebde631005ae15aba91eb8f36fbe7.exe 86 PID 2000 wrote to memory of 1356 2000 8abebde631005ae15aba91eb8f36fbe7.exe 86 PID 2000 wrote to memory of 1356 2000 8abebde631005ae15aba91eb8f36fbe7.exe 86 PID 2000 wrote to memory of 1356 2000 8abebde631005ae15aba91eb8f36fbe7.exe 86 PID 2000 wrote to memory of 1356 2000 8abebde631005ae15aba91eb8f36fbe7.exe 86 PID 1356 wrote to memory of 2664 1356 8abebde631005ae15aba91eb8f36fbe7.exe 89 PID 1356 wrote to memory of 2664 1356 8abebde631005ae15aba91eb8f36fbe7.exe 89 PID 1356 wrote to memory of 2664 1356 8abebde631005ae15aba91eb8f36fbe7.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\8abebde631005ae15aba91eb8f36fbe7.exe"C:\Users\Admin\AppData\Local\Temp\8abebde631005ae15aba91eb8f36fbe7.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uppEqmN.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uppEqmN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp89C1.tmp"2⤵
- Creates scheduled task(s)
PID:2268
-
-
C:\Users\Admin\AppData\Local\Temp\8abebde631005ae15aba91eb8f36fbe7.exe"C:\Users\Admin\AppData\Local\Temp\8abebde631005ae15aba91eb8f36fbe7.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 17602⤵
- Program crash
PID:4320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2000 -ip 20001⤵PID:5116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8abebde631005ae15aba91eb8f36fbe7.exe.log
Filesize1KB
MD5fc57dcb1a143324278cf61d88f8c67ad
SHA1807d546b4296091d11a8df6a11157a5f12dd7fd5
SHA256a75686eed807c36b056311dddc898582fd4063135fc5728d2bdd3c6e1f5ab688
SHA51233ac55a68ac8371bf00af55e38455e886dc6aa681388622a55bf4473b1f4eda4d75a8211ea61df288ccdb26e838785da08094a7f1aac878da6ccd2e573f3bcb8
-
Filesize
1KB
MD5c25830118ff75c9d5efaffb74ef52a68
SHA1015710f73062a3cb2c1932d95328ed2e837a2ebb
SHA256791d7c6b1322be2042511f007e05111f45be8a4079ea949acef14f9680bbfdbe
SHA5124c7d5d8aba21151ce0b49dc4fffbec6036886960dddecf4da681057c107d02e27581fef5bcf572a8fbfcc82e8ae786c8a5c94a0e0ba3fce8c4355d633ecc0a14