Overview

overview

10

Static

static

5b2acc95cb...ff.exe

windows7-x64

10

5b2acc95cb...ff.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    155s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-08-2022 00:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b2acc95cb4ff1f813a5f60e61899d61823ce4433e5a6c0e4d70ca9deac052ff.exe

  • Size

    1018KB

  • MD5

    2933735ffb865073c2b817e16c631a86

  • SHA1

    90888d8cb8be66f087d3ffc48fbd30b815bb7bdf

  • SHA256

    5b2acc95cb4ff1f813a5f60e61899d61823ce4433e5a6c0e4d70ca9deac052ff

  • SHA512

    168a98aedeaff9a9de0f919f10afb456a76667e2eea375123860edf86390a23441d299e842cc42b42c9424b754460c64f2c02618e364bb84ba5f31e73aa0f072

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b2acc95cb4ff1f813a5f60e61899d61823ce4433e5a6c0e4d70ca9deac052ff.exe
    "C:\Users\Admin\AppData\Local\Temp\5b2acc95cb4ff1f813a5f60e61899d61823ce4433e5a6c0e4d70ca9deac052ff.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oialCag" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF1BE.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1488
    • C:\Users\Admin\AppData\Local\Temp\5b2acc95cb4ff1f813a5f60e61899d61823ce4433e5a6c0e4d70ca9deac052ff.exe
      "C:\Users\Admin\AppData\Local\Temp\5b2acc95cb4ff1f813a5f60e61899d61823ce4433e5a6c0e4d70ca9deac052ff.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpF1BE.tmp
    Filesize

    1KB

    MD5

    1f207d87b87a60c25e609c5635f96d1f

    SHA1

    d357c146f07fe2a6aa81f89941dbe9af39723382

    SHA256

    63835e6a8ae11bbe47dc470e0fcea748be4040efd67c1c53b0c0fb37b6410938

    SHA512

    22aee739294e953a708edee30222b8d20b8a5084353a83f203a65ca38c9ddfaf44dfd4ca798084333356c1ec984f1defed88b1695b4d7dc97341f93dccfc4236

    Download Submit
  • memory/1060-130-0x0000000074CA0000-0x0000000075251000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1060-131-0x0000000074CA0000-0x0000000075251000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1060-137-0x0000000074CA0000-0x0000000075251000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1488-132-0x0000000000000000-mapping.dmp
    Download
  • memory/3204-134-0x0000000000000000-mapping.dmp
    Download
  • memory/3204-136-0x0000000074CA0000-0x0000000075251000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/3204-138-0x0000000074CA0000-0x0000000075251000-memory.dmp
    Filesize

    5.7MB

    Download