8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178

General

Target

8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe
Size

220KB
MD5

6f479074761ed9fcd8eab62e378dd861
SHA1

8dfbcabb2c4c5c7aeaf13849c142073b14ed7c45
SHA256

8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178
SHA512

171dfb6f9fabbdc794cf070e37e37900c985c5c7c1cd34fb944ffae18d552d1e0da58531b64a681d76c1d60d27552ad08220c633beb8e1a52a58ea9d070c7946

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe

description	pid	process	target process
PID 1996 set thread context of 4508	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1472 4508 WerFault.exe svchost.exe

pid	pid_target	process	target process
1472	4508	WerFault.exe	svchost.exe

NTFS ADS 1 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe:Zone.Identifier	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe

description pid process

Token: SeDebugPrivilege 1996 8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe

description	pid	process
Token: SeDebugPrivilege	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe

description	pid	process	target process
PID 1996 wrote to memory of 2868	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	cmd.exe
PID 1996 wrote to memory of 2868	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	cmd.exe
PID 1996 wrote to memory of 2868	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	cmd.exe
PID 1996 wrote to memory of 4508	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	svchost.exe
PID 1996 wrote to memory of 4508	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	svchost.exe
PID 1996 wrote to memory of 4508	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	svchost.exe
PID 1996 wrote to memory of 4508	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	svchost.exe
PID 1996 wrote to memory of 4508	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	svchost.exe
PID 1996 wrote to memory of 4508	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	svchost.exe
PID 1996 wrote to memory of 4508	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	svchost.exe
PID 1996 wrote to memory of 4508	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	svchost.exe
PID 1996 wrote to memory of 4508	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	svchost.exe
PID 1996 wrote to memory of 4508	1996	8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe
"C:\Users\Admin\AppData\Local\Temp\8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\8d81b5ca59d55a84a33424e8d19502255ed81b56e08d00ebd2741598f7d4c178.exe:Zone.Identifier"
  2⤵
  - NTFS ADS
  PID:2868
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 464
    3⤵
    - Program crash
    PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4508 -ip 4508
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-136-0x0000000006910000-0x0000000006EB4000-memory.dmp

Filesize
5.6MB

Download
memory/1996-131-0x00000000057B0000-0x00000000057D2000-memory.dmp

Filesize
136KB

Download
memory/1996-132-0x0000000005900000-0x0000000005992000-memory.dmp

Filesize
584KB

Download
memory/1996-133-0x00000000057E0000-0x0000000005802000-memory.dmp

Filesize
136KB

Download
memory/1996-134-0x00000000059A0000-0x0000000005A06000-memory.dmp

Filesize
408KB

Download
memory/1996-130-0x0000000000E70000-0x0000000000EAC000-memory.dmp

Filesize
240KB

Download
memory/1996-137-0x0000000006EC0000-0x0000000007082000-memory.dmp

Filesize
1.8MB

Download
memory/1996-138-0x0000000006810000-0x00000000068AC000-memory.dmp

Filesize
624KB

Download
memory/2868-135-0x0000000000000000-mapping.dmp

Download
memory/4508-139-0x0000000000000000-mapping.dmp

Download
memory/4508-141-0x0000000000480000-0x0000000000492000-memory.dmp

Filesize
72KB

Download
memory/4508-144-0x0000000000480000-0x0000000000492000-memory.dmp

Filesize
72KB

Download
memory/4508-147-0x0000000000480000-0x0000000000492000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads