Analysis
-
max time kernel
178s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31/07/2022, 05:17
Static task
static1
Behavioral task
behavioral1
Sample
mvs.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
mvs.exe
Resource
win10v2004-20220721-en
General
-
Target
mvs.exe
-
Size
476KB
-
MD5
faf25564825a05a4c01870cdc0535525
-
SHA1
54d7f92637e31e4c1aed0a58b690d7d99886c380
-
SHA256
82732e47492148243ee3fb338c93d43b9a9984f39e3409327600cffc5766af1b
-
SHA512
b44be2421a074ea986336b0c179a6d416c845ae44b4ca67d31594506bd79a3fdfa2907d7bcf7b3c46f1d942e0b057fbd8bce3a02bceb5bf91e1e70c30a57f0db
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2580 a.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation mvs.exe Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation cmd.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4292 sc.exe 4476 sc.exe 4520 sc.exe 4872 sc.exe 2028 sc.exe 4368 sc.exe 4088 sc.exe 716 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier reg.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2484 systeminfo.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Local Settings cmd.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4672 reg.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2648 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4364 wrote to memory of 2580 4364 mvs.exe 83 PID 4364 wrote to memory of 2580 4364 mvs.exe 83 PID 4364 wrote to memory of 2580 4364 mvs.exe 83 PID 2580 wrote to memory of 4000 2580 a.exe 86 PID 2580 wrote to memory of 4000 2580 a.exe 86 PID 2580 wrote to memory of 4000 2580 a.exe 86 PID 4000 wrote to memory of 2484 4000 cmd.exe 87 PID 4000 wrote to memory of 2484 4000 cmd.exe 87 PID 4000 wrote to memory of 2484 4000 cmd.exe 87 PID 4000 wrote to memory of 1420 4000 cmd.exe 93 PID 4000 wrote to memory of 1420 4000 cmd.exe 93 PID 4000 wrote to memory of 1420 4000 cmd.exe 93 PID 4000 wrote to memory of 636 4000 cmd.exe 94 PID 4000 wrote to memory of 636 4000 cmd.exe 94 PID 4000 wrote to memory of 636 4000 cmd.exe 94 PID 4000 wrote to memory of 2252 4000 cmd.exe 95 PID 4000 wrote to memory of 2252 4000 cmd.exe 95 PID 4000 wrote to memory of 2252 4000 cmd.exe 95 PID 4000 wrote to memory of 2424 4000 cmd.exe 96 PID 4000 wrote to memory of 2424 4000 cmd.exe 96 PID 4000 wrote to memory of 2424 4000 cmd.exe 96 PID 4000 wrote to memory of 404 4000 cmd.exe 97 PID 4000 wrote to memory of 404 4000 cmd.exe 97 PID 4000 wrote to memory of 404 4000 cmd.exe 97 PID 4000 wrote to memory of 4276 4000 cmd.exe 98 PID 4000 wrote to memory of 4276 4000 cmd.exe 98 PID 4000 wrote to memory of 4276 4000 cmd.exe 98 PID 4000 wrote to memory of 3656 4000 cmd.exe 99 PID 4000 wrote to memory of 3656 4000 cmd.exe 99 PID 4000 wrote to memory of 3656 4000 cmd.exe 99 PID 4000 wrote to memory of 516 4000 cmd.exe 102 PID 4000 wrote to memory of 516 4000 cmd.exe 102 PID 4000 wrote to memory of 516 4000 cmd.exe 102 PID 4000 wrote to memory of 1376 4000 cmd.exe 101 PID 4000 wrote to memory of 1376 4000 cmd.exe 101 PID 4000 wrote to memory of 1376 4000 cmd.exe 101 PID 4000 wrote to memory of 2236 4000 cmd.exe 100 PID 4000 wrote to memory of 2236 4000 cmd.exe 100 PID 4000 wrote to memory of 2236 4000 cmd.exe 100 PID 4000 wrote to memory of 4672 4000 cmd.exe 103 PID 4000 wrote to memory of 4672 4000 cmd.exe 103 PID 4000 wrote to memory of 4672 4000 cmd.exe 103 PID 4000 wrote to memory of 872 4000 cmd.exe 104 PID 4000 wrote to memory of 872 4000 cmd.exe 104 PID 4000 wrote to memory of 872 4000 cmd.exe 104 PID 4000 wrote to memory of 1416 4000 cmd.exe 105 PID 4000 wrote to memory of 1416 4000 cmd.exe 105 PID 4000 wrote to memory of 1416 4000 cmd.exe 105 PID 4000 wrote to memory of 2868 4000 cmd.exe 106 PID 4000 wrote to memory of 2868 4000 cmd.exe 106 PID 4000 wrote to memory of 2868 4000 cmd.exe 106 PID 4000 wrote to memory of 1140 4000 cmd.exe 107 PID 4000 wrote to memory of 1140 4000 cmd.exe 107 PID 4000 wrote to memory of 1140 4000 cmd.exe 107 PID 4000 wrote to memory of 2392 4000 cmd.exe 108 PID 4000 wrote to memory of 2392 4000 cmd.exe 108 PID 4000 wrote to memory of 2392 4000 cmd.exe 108 PID 4000 wrote to memory of 4640 4000 cmd.exe 109 PID 4000 wrote to memory of 4640 4000 cmd.exe 109 PID 4000 wrote to memory of 4640 4000 cmd.exe 109 PID 4640 wrote to memory of 3352 4640 cmd.exe 110 PID 4640 wrote to memory of 3352 4640 cmd.exe 110 PID 4640 wrote to memory of 3352 4640 cmd.exe 110 PID 4000 wrote to memory of 5012 4000 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\mvs.exe"C:\Users\Admin\AppData\Local\Temp\mvs.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\windows\temp\a.exe"C:\windows\temp\a.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9EC0.tmp\a.bat" "C:\windows\temp\a.exe""3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo /fo list4⤵
- Gathers system information
PID:2484
-
-
C:\Windows\SysWOW64\find.exeFind /i "OS Name: "4⤵PID:1420
-
-
C:\Windows\SysWOW64\find.exeFind /i "OS Version: "4⤵PID:636
-
-
C:\Windows\SysWOW64\find.exeFind /i "System Model:"4⤵PID:2252
-
-
C:\Windows\SysWOW64\find.exeFind /i "System Manufacturer: "4⤵PID:2424
-
-
C:\Windows\SysWOW64\find.exeFind /i "BIOS Version:"4⤵PID:404
-
-
C:\Windows\SysWOW64\find.exeFind /i "Total Physical Memory: "4⤵PID:4276
-
-
C:\Windows\SysWOW64\find.exeFind /i "Time Zone:"4⤵PID:3656
-
-
C:\Windows\SysWOW64\find.exeFind /i "Original Install Date: "4⤵PID:2236
-
-
C:\Windows\SysWOW64\find.exeFind /i "Connection Name:"4⤵PID:1376
-
-
C:\Windows\SysWOW64\find.exeFind /i "DHCP Server:"4⤵PID:516
-
-
C:\Windows\SysWOW64\reg.exereg query HKLM\Hardware\Description\System\CentralProcessor\0 /v Identifier4⤵
- Checks processor information in registry
- Modifies registry key
PID:4672
-
-
C:\Windows\SysWOW64\find.exeFind /i "x86"4⤵PID:872
-
-
C:\Windows\SysWOW64\getmac.exegetmac /nh4⤵PID:1416
-
-
C:\Windows\SysWOW64\reg.exeReg query "HKEY_CLASSES_ROOT\http\shell\open\command" /ve4⤵PID:2868
-
-
C:\Windows\SysWOW64\findstr.exeFindstr /i "Program Files" c:\windows\temp\c.txt4⤵PID:1140
-
-
C:\Windows\SysWOW64\reg.exeReg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer" /v SVCversion4⤵PID:2392
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer" /v SVCversion4⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\reg.exeReg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer" /v SVCversion5⤵PID:3352
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion4⤵PID:5012
-
C:\Windows\SysWOW64\reg.exeReg query "HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion5⤵PID:2416
-
-
-
C:\Windows\SysWOW64\reg.exeReg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin" /v DisplayVersion4⤵PID:2328
-
-
C:\Windows\SysWOW64\findstr.exeFindstr /i "REG_SZ" c:\windows\temp\123.txt4⤵PID:5056
-
-
C:\Windows\SysWOW64\reg.exereg query "HKLM\SOFTWARE\Adobe\Acrobat Reader"4⤵PID:4176
-
-
C:\Windows\SysWOW64\reg.exeReg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Plug-in"4⤵PID:1268
-
-
C:\Windows\SysWOW64\findstr.exeFindstr /i "1" c:\windows\temp\123.txt4⤵PID:728
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver "4⤵PID:4036
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "5\.1\."4⤵PID:4012
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc query mpssvc | findstr /i "STATE"4⤵PID:1824
-
C:\Windows\SysWOW64\sc.exesc query mpssvc5⤵
- Launches sc.exe
PID:4292
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "STATE"5⤵PID:1688
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc query mpssvc | findstr /i "installed"4⤵PID:1444
-
C:\Windows\SysWOW64\sc.exesc query mpssvc5⤵
- Launches sc.exe
PID:4476
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "installed"5⤵PID:4332
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc query wuauserv | findstr /i "STATE"4⤵PID:4316
-
C:\Windows\SysWOW64\sc.exesc query wuauserv5⤵
- Launches sc.exe
PID:4520
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "STATE"5⤵PID:4224
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc query wuauserv | findstr /i "installed"4⤵PID:3532
-
C:\Windows\SysWOW64\sc.exesc query wuauserv5⤵
- Launches sc.exe
PID:4872
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "installed"5⤵PID:3380
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc query wscsvc | findstr /i "STATE"4⤵PID:1652
-
C:\Windows\SysWOW64\sc.exesc query wscsvc5⤵
- Launches sc.exe
PID:2028
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "STATE"5⤵PID:2968
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc query wscsvc | findstr /i "installed"4⤵PID:2156
-
C:\Windows\SysWOW64\sc.exesc query wscsvc5⤵
- Launches sc.exe
PID:4368
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "installed"5⤵PID:4180
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc query msiserver | findstr /i "STATE"4⤵PID:1648
-
C:\Windows\SysWOW64\sc.exesc query msiserver5⤵
- Launches sc.exe
PID:4088
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "STATE"5⤵PID:2976
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc query msiserver | findstr /i "installed"4⤵PID:4228
-
C:\Windows\SysWOW64\sc.exesc query msiserver5⤵
- Launches sc.exe
PID:716
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "installed"5⤵PID:1016
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\windows\temp\Report.txt4⤵
- Opens file in notepad (likely ransom note)
PID:2648
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5121b06bb9a454fcd9c1c618c25f193dc
SHA159b3de866e3848e48e877d7c115e64cb725c4c7e
SHA25681800740d6cc41785cd030ca001d2182b0ef21bb3b4ec5054fe152e8e783ca47
SHA5120d30cb02f589cfe315091c24421467d35e2490cd10009b88d3664e0e65c02723634fd62444412a45e67affa1352a3352d09bd871d19a2100d8fc5e72fd6bd9ab
-
Filesize
216KB
MD56b2c8c3958f0e87c1b111390127eaff8
SHA14e7089791266f8daf2cf47a47db7cd2ad117bd8e
SHA256adb2ff6be2d36cd0ed909084dfe47f85aee7e40184bf87d7aff9eff4fb3ba1f0
SHA512b4e1e4bf2b1479b721dd2981a0ea05006ebacf569e1a1974b9678f058793f1103e5c4533843f1582b59edf84c4c7e83d2eed12c5416a2efc45edb94da155eb12
-
Filesize
1KB
MD58ab01b2f502d96ff4e2f3c9e13b649c0
SHA134160d5489aa80edae34a2256ecdd2ef4d2c3b36
SHA25616ce36b2195b93f30f57b817bdb21029e04588463b0f829f68f38f5ebefc48e1
SHA512430fb8fae511c68015b3710d4446670b1945bdd69900297b6d5870d3ab924a437733cc29995c61888ff7e6ad7507efd44ab823f8205b126f635ebe8e05e8ab35
-
Filesize
216KB
MD56b2c8c3958f0e87c1b111390127eaff8
SHA14e7089791266f8daf2cf47a47db7cd2ad117bd8e
SHA256adb2ff6be2d36cd0ed909084dfe47f85aee7e40184bf87d7aff9eff4fb3ba1f0
SHA512b4e1e4bf2b1479b721dd2981a0ea05006ebacf569e1a1974b9678f058793f1103e5c4533843f1582b59edf84c4c7e83d2eed12c5416a2efc45edb94da155eb12
-
Filesize
211KB
MD5ee8eeff90bf2db3a002a27990a82cb19
SHA1647c8de3585d87b8c297fe2bd0f54e8e4460aa55
SHA2562dc4292328bbd11f3142311145ec6a78247d244a53d67be5c8d4b66584a5fdc5
SHA51239325f0465d081b270debe39531337b99d01a1806c842f82e4ed922122865ba1f02ccca37fde8613dc9de4a46ba5cb5255126d56b44495dfdd36b723cf65d761
-
Filesize
128B
MD5628d983719759839517e5efe60f5f0d3
SHA14ffb5d09376b369071da2c2ec75f6e3f44d11502
SHA25613fc04ef802cc8ba2926ccee55b7e4d8b13db1d22545ab123ca29fd61e7a71de
SHA51237bbbd28b99eaec98de63b12cdbcc55fac73258f69dabe68cff8d33c47f41eee7175c14f09d9baae5fe17dd6e7360a3f132aba5ad46e79de55fd7324bddcc07c
-
Filesize
30KB
MD5a48b1c06219a01a60cd8d4d45440bde9
SHA134af23607ad5afa9e61b6a96cec811e6bdc50b4a
SHA2565c3736e37168dae7e431a31d5c4e0d351271d37804787ee3b8fa6e46413ba880
SHA5128f6b29be451582e47743009d95637f540dea4d7c93e685687e8b8f130a1cf535a4030722367fd4ac49639c19ce35c779c0cfef315eea038d9a4434474c7690f4
-
Filesize
70KB
MD5a279f4091f940c15a288767f4285c0ff
SHA14572dc2ae3cdc4d7ea75249037bdb2d394d7ec83
SHA2567852ee782a6310be5d1b94df136299060ddff820dbe8bb2a2b79fe92eec0b7c0
SHA5122f3a448a8491add4c43e3d059f89db94fdb988f9930b8b79cc231b865d3d5007c62a54c08416814b73bad98ace63df6788c8887d1c2458250b37c628797f70a9