Analysis

  • max time kernel
    130s
  • max time network
    76s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220718-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-07-2022 18:03

General

  • Target

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe

  • Size

    950KB

  • MD5

    72a29aa3364417f3194f8e34fad82668

  • SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

  • SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

  • SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

Score
9/10

Malware Config

Signatures

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe
    "C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe
      C:\Users\Admin\AppData\Local\Temp\4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Users\Admin\AppData\Roaming\Windows Update.exe
        "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2608
        • C:\Users\Admin\AppData\Roaming\Windows Update.exe
          C:\Users\Admin\AppData\Roaming\Windows Update.exe"
          4⤵
          • Executes dropped EXE
          PID:2044

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    950KB

    MD5

    72a29aa3364417f3194f8e34fad82668

    SHA1

    cf4940254b4e130addb8b76f6d654bd423fc341c

    SHA256

    4e4da37e825b035f8be12be4d37fffcd76b1e93b216c99e0e12d585697dafc42

    SHA512

    0f2a2b3d7344325050f8c92b2f6d260971581b722f9a7abb2277f761a3bc70f6300e1f09180f40c48f90a5c9dfd9c6ab87ec43b63bd4efc8b7697cfff41f5d82

  • memory/2564-152-0x0000000074E30000-0x00000000753E1000-memory.dmp

    Filesize

    5.7MB

  • memory/2564-143-0x00000000777C0000-0x0000000077963000-memory.dmp

    Filesize

    1.6MB

  • memory/2564-144-0x00000000777C0000-0x0000000077963000-memory.dmp

    Filesize

    1.6MB

  • memory/2564-145-0x0000000074E30000-0x00000000753E1000-memory.dmp

    Filesize

    5.7MB

  • memory/2564-140-0x00000000021F0000-0x0000000002280000-memory.dmp

    Filesize

    576KB

  • memory/2564-137-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2564-151-0x00000000777C0000-0x0000000077963000-memory.dmp

    Filesize

    1.6MB

  • memory/2608-155-0x00000000777C0000-0x0000000077963000-memory.dmp

    Filesize

    1.6MB

  • memory/3224-132-0x00000000022C0000-0x00000000022C7000-memory.dmp

    Filesize

    28KB

  • memory/3224-134-0x00000000777C0000-0x0000000077963000-memory.dmp

    Filesize

    1.6MB