Analysis
- max time kernel
74s - max time network
76s - platform
windows10-2004_x64 - resource
win10v2004-20220722-en - resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system - submitted
31/07/2022, 23:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe
Resource
win7-20220715-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe
Resource
win10v2004-20220722-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe
- Size 10.7MB
- Sample220731-3by91scfc2
- SHA256 bb55d270dabacf3c508d57da491d4cbc7663add182c5b78e43e717b2c74a6897
- MD5 fad4e55f6f7f8870c87b77612201fa48
- SHA1 c979bd9f8c65cb7b923be3b2cb63a74ce23adeb2
- SHA512 b8134083e0a0ec39d4477eec8ac55d73db8a73644f766ab69515aaa57fa2e8d663dcec35b7c6d35caf67fbb2a503d6aea36648e2d495375cc840a9489a4442c9
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3408 StartAllBack.v3.4.3.srv_lKx60.exe 4364 StartAllBack.v3.4.3_Kuxhu.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe - Loads dropped DLL 3 IoCs
pid Process 4364 StartAllBack.v3.4.3_Kuxhu.exe 4364 StartAllBack.v3.4.3_Kuxhu.exe 4364 StartAllBack.v3.4.3_Kuxhu.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3408 StartAllBack.v3.4.3.srv_lKx60.exe 3408 StartAllBack.v3.4.3.srv_lKx60.exe - Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe - Suspicious use of SendNotifyMessage 29 IoCs
pid Process 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4364 StartAllBack.v3.4.3_Kuxhu.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2304 wrote to memory of 3408 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 74 PID 2304 wrote to memory of 3408 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 74 PID 2304 wrote to memory of 3408 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 74 PID 2304 wrote to memory of 4364 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 76 PID 2304 wrote to memory of 4364 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 76 PID 2304 wrote to memory of 4364 2304 BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe"C:\Users\Admin\AppData\Local\Temp\BB55D270DABACF3C508D57DA491D4CBC7663ADD182C5B.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\ProgramData\StartAllBack.v3.4.3.srv_lKx60.exe"C:\ProgramData\StartAllBack.v3.4.3.srv_lKx60.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3408
-
-
C:\ProgramData\StartAllBack.v3.4.3_Kuxhu.exe"C:\ProgramData\StartAllBack.v3.4.3_Kuxhu.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4364
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\StartAllBack.v3.4.3.srv_lKx60.exe
- Size 6.6MB
- SHA256 e02eefcebf911b522200292177810b311fe98f4f37494951afcd0a65c8699ece
- MD5 d7a78ac7e51220764c6de47a5308c6b7
- SHA1 d9cc794c5ccba3538ee4dc37d654a2132c91badc
- SHA512 417ced13c228187231f6a0a8ca975497e404c8a620b8d2a76a670ff2b53d556fb744a1ea7ae0c3643d49e81237c07d8dad5e876002144f2cda7ee703d7374995
- SSDEEP 98304:K1lldaWa6rZvmE0l/L5d4ugZ6wHobwJc9TIjE5wr9UxeBZfr4dGea0xX2:GYWafZEugj7J48x9yv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\StartAllBack.v3.4.3.srv_lKx60.exe
- Size 6.6MB
- SHA256 e02eefcebf911b522200292177810b311fe98f4f37494951afcd0a65c8699ece
- MD5 d7a78ac7e51220764c6de47a5308c6b7
- SHA1 d9cc794c5ccba3538ee4dc37d654a2132c91badc
- SHA512 417ced13c228187231f6a0a8ca975497e404c8a620b8d2a76a670ff2b53d556fb744a1ea7ae0c3643d49e81237c07d8dad5e876002144f2cda7ee703d7374995
- SSDEEP 98304:K1lldaWa6rZvmE0l/L5d4ugZ6wHobwJc9TIjE5wr9UxeBZfr4dGea0xX2:GYWafZEugj7J48x9yv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\StartAllBack.v3.4.3_Kuxhu.exe
- Size 3.2MB
- SHA256 8957e6383961b1a1573b6599c851dc2b951ca9c3c2901f2b1f79d22768b78878
- MD5 ad3d29e6c9593c83b86d8a750b623dc7
- SHA1 1ca8e49d6a65a22954b7c95cb06a680d7b2977a3
- SHA512 72bcc29e23b5933c9242f12e561e2ebd7644610a2b5076d9c6a4fca939a9645a590fff4c32e8f5983c4ca8faa7e34260e280a5bb116b1dd7588bd45c7ad834ea
- SSDEEP 49152:C0kG0kCWbogjaNta4bElWD3g+Zth9fHnnYfvXp5qIlv4omumN5Y05HGQGS9xy9BE:K/oaN04TQ+HHnY3XptwFYiGEE5bc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\StartAllBack.v3.4.3_Kuxhu.exe
- Size 3.2MB
- SHA256 8957e6383961b1a1573b6599c851dc2b951ca9c3c2901f2b1f79d22768b78878
- MD5 ad3d29e6c9593c83b86d8a750b623dc7
- SHA1 1ca8e49d6a65a22954b7c95cb06a680d7b2977a3
- SHA512 72bcc29e23b5933c9242f12e561e2ebd7644610a2b5076d9c6a4fca939a9645a590fff4c32e8f5983c4ca8faa7e34260e280a5bb116b1dd7588bd45c7ad834ea
- SSDEEP 49152:C0kG0kCWbogjaNta4bElWD3g+Zth9fHnnYfvXp5qIlv4omumN5Y05HGQGS9xy9BE:K/oaN04TQ+HHnY3XptwFYiGEE5bc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsr3025.tmp\LangDLL.dll
- Size 5KB
- SHA256 20e642707ef82852bcf153254cb94b629b93ee89a8e8a03f838eef6cbb493319
- MD5 109b201717ab5ef9b5628a9f3efef36f
- SHA1 98db1f0cc5f110438a02015b722778af84d50ea7
- SHA512 174e241863294c12d0705c9d2de92f177eb8f3d91125b183d8d4899c89b9a202a4c7a81e0a541029a4e52513eee98029196a4c3b8663b479e69116347e5de5b4
- SSDEEP 48:S46+/+lTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8m0ofjLl:zMluPbOBtWZBV8jAWiAJCdv2CmHL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsr3025.tmp\System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsr3025.tmp\nsDialogs.dll
- Size 9KB
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- MD5 SHA1 SHA512 SSDEEP