Analysis
- max time kernel
152s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
13/07/2022, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
virussign.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
virussign.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target virussign.exe
- Size 738KB
- Sample220713-rnfgwsfbcq
- SHA256 24b97bd8e51250efbf2bd9115924aed5df1c6ca1920c289eb8a340ea78256b30
- MD5 62e6c33ebddc9de4a2f56136857b7a00
- SHA1 c7c762ce627e05c851d9514ae830a550f56c2d03
- SHA512 3d6f27c1be94ea6c00e025ef7104956a871fe4af4690dfbd79e7a258435f91a10b767facc31d140e2a287bf1e315157d763233b1c854fcb254d17fe1e9997c6e
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3660 tcpscrex.exe -
resource yara_rule behavioral2/memory/4628-130-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3660-134-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/files/0x0006000000022ed9-133.dat upx behavioral2/files/0x0006000000022ed9-132.dat upx behavioral2/memory/4628-135-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3660-136-0x0000000000400000-0x00000000004B7000-memory.dmp upx - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation virussign.exe - AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4628-130-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral2/memory/3660-134-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral2/files/0x0006000000022ed9-133.dat autoit_exe behavioral2/files/0x0006000000022ed9-132.dat autoit_exe behavioral2/memory/4628-135-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe behavioral2/memory/3660-136-0x0000000000400000-0x00000000004B7000-memory.dmp autoit_exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Managemenot\Monitor\tcpscrex.exe virussign.exe File opened for modification C:\Program Files\Managemenot\Monitor\tcpscrex.exe virussign.exe File created C:\Program Files (x86)\Activxr\Rescuer.exe tcpscrex.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe 3660 tcpscrex.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4628 wrote to memory of 3660 4628 virussign.exe 80 PID 4628 wrote to memory of 3660 4628 virussign.exe 80 PID 4628 wrote to memory of 3660 4628 virussign.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.exe"C:\Users\Admin\AppData\Local\Temp\virussign.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Program Files\Managemenot\Monitor\tcpscrex.exe"C:\Program Files\Managemenot\Monitor\tcpscrex.exe" 0.0.0.02⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3660
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Managemenot\Monitor\tcpscrex.exe
- Size 738KB
- SHA256 7f80d75739346e000d2e18d4e94c7804a3e49528dc2885bc164d928b3d42d024
- MD5 811517dd03ede020fbdc17d946a09a67
- SHA1 922a20634225a05efbd2ccdfb0b95f256405b221
- SHA512 9c4313247ddab2b7d520c2c380511fece855210512d937ff75fc20672c98f030c794991a65b7297b86bd31cc44aa14838f311414120a5e16c94efe856e96c06c
- SSDEEP 12288:TaWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:WaHMv6Corjqnyz3/06
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Managemenot\Monitor\tcpscrex.exe
- Size 738KB
- SHA256 7f80d75739346e000d2e18d4e94c7804a3e49528dc2885bc164d928b3d42d024
- MD5 811517dd03ede020fbdc17d946a09a67
- SHA1 922a20634225a05efbd2ccdfb0b95f256405b221
- SHA512 9c4313247ddab2b7d520c2c380511fece855210512d937ff75fc20672c98f030c794991a65b7297b86bd31cc44aa14838f311414120a5e16c94efe856e96c06c
- SSDEEP 12288:TaWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:WaHMv6Corjqnyz3/06
- MD5 SHA1 SHA512 SSDEEP