1d7944caa07fadaf9e6168ed67911df375d6ea59f834e40dbf4bc9fa8735ffee

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2022, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
835629947682.exe
Size 757KB
Sample220802-mfylaafabm
SHA256 1d7944caa07fadaf9e6168ed67911df375d6ea59f834e40dbf4bc9fa8735ffee
MD5 7486a78db476097c9087bcc642bf8204
SHA1 e58943c0639c115c02767a8ce9845b6c1a8e0190
SHA512 37aed75e022a1175357e60e084b3befa7d1f2fd0dc5053e455b2d07a81607149179b764859c84e055fa5f62a5a1f36eed7b0ec53690881f985e2a76592ad8b43
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	835629947682.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1196 set thread context of 1348	1196	835629947682.exe	98
PID 1348 set thread context of 2836	1348	835629947682.exe	40
PID 4092 set thread context of 2836	4092	systray.exe	40

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
1196	835629947682.exe
1196	835629947682.exe
1196	835629947682.exe
1196	835629947682.exe
1196	835629947682.exe
1196	835629947682.exe
1196	835629947682.exe
1348	835629947682.exe
1348	835629947682.exe
1348	835629947682.exe
1348	835629947682.exe
1348	835629947682.exe
1348	835629947682.exe
1348	835629947682.exe
1348	835629947682.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe
4092	systray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1348	835629947682.exe
1348	835629947682.exe
1348	835629947682.exe
4092	systray.exe
4092	systray.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	835629947682.exe
Token: SeDebugPrivilege	1348	835629947682.exe
Token: SeDebugPrivilege	4092	systray.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1348	1196	835629947682.exe	98
PID 1196 wrote to memory of 1348	1196	835629947682.exe	98
PID 1196 wrote to memory of 1348	1196	835629947682.exe	98
PID 1196 wrote to memory of 1348	1196	835629947682.exe	98
PID 1196 wrote to memory of 1348	1196	835629947682.exe	98
PID 1196 wrote to memory of 1348	1196	835629947682.exe	98
PID 2836 wrote to memory of 4092	2836	Explorer.EXE	99
PID 2836 wrote to memory of 4092	2836	Explorer.EXE	99
PID 2836 wrote to memory of 4092	2836	Explorer.EXE	99

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\835629947682.exe
  "C:\Users\Admin\AppData\Local\Temp\835629947682.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Users\Admin\AppData\Local\Temp\835629947682.exe
    "C:\Users\Admin\AppData\Local\Temp\835629947682.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1348
- C:\Windows\SysWOW64\systray.exe
  "C:\Windows\SysWOW64\systray.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-131-0x00000000054F0000-0x0000000005A94000-memory.dmp

Download

memory/1196-132-0x0000000004E70000-0x0000000004F02000-memory.dmp

Download

memory/1196-133-0x00000000052C0000-0x00000000052CA000-memory.dmp

Download

memory/1196-134-0x000000000B150000-0x000000000B1EC000-memory.dmp

Download

memory/1196-135-0x0000000000C30000-0x0000000000C96000-memory.dmp

Download

memory/1196-130-0x0000000000430000-0x00000000004F2000-memory.dmp

Download

memory/1348-143-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1348-137-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/1348-138-0x0000000001100000-0x000000000144A000-memory.dmp

Download

memory/1348-140-0x00000000010E0000-0x00000000010F1000-memory.dmp

Download

memory/2836-141-0x0000000003240000-0x00000000033AB000-memory.dmp

Download

memory/2836-148-0x0000000003580000-0x0000000003650000-memory.dmp

Download

memory/2836-150-0x0000000003580000-0x0000000003650000-memory.dmp

Download

memory/4092-145-0x0000000002850000-0x0000000002B9A000-memory.dmp

Download

memory/4092-146-0x0000000000A00000-0x0000000000A2D000-memory.dmp

Download

memory/4092-144-0x0000000000300000-0x0000000000306000-memory.dmp

Download

memory/4092-147-0x00000000027C0000-0x0000000002850000-memory.dmp

Download

memory/4092-149-0x0000000000A00000-0x0000000000A2D000-memory.dmp

Download