2a48fa5118bf1c97de6a6b7b0a45bcc95bd678d54f31e2f2d003e5f3ea49c780

General

Target

2ed2a1d6604afeaa681f4c66dcd84194.exe
Size

141KB
MD5

2ed2a1d6604afeaa681f4c66dcd84194
SHA1

6134d837220afe9377cd78950c8aca43dde08d8c
SHA256

2a48fa5118bf1c97de6a6b7b0a45bcc95bd678d54f31e2f2d003e5f3ea49c780
SHA512

b6dc02f1974d0d90b171432156b85044ab67b51c00c9a6f2ce98562342dd2afb64ac36ae57e291d37da0db564c7191567183917971455969d9eb930c920e8979

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

sihost.exe

pid process

4756 sihost.exe

pid	process
4756	sihost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2ed2a1d6604afeaa681f4c66dcd84194.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	2ed2a1d6604afeaa681f4c66dcd84194.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

736 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1788 timeout.exe

pid	process
736	schtasks.exe

pid	process
1788	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

2ed2a1d6604afeaa681f4c66dcd84194.exe

pid	process
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
4732	2ed2a1d6604afeaa681f4c66dcd84194.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2ed2a1d6604afeaa681f4c66dcd84194.exesihost.exe

description pid process

Token: SeDebugPrivilege 4732 2ed2a1d6604afeaa681f4c66dcd84194.exe
Token: SeDebugPrivilege 4756 sihost.exe

description	pid	process
Token: SeDebugPrivilege	4732	2ed2a1d6604afeaa681f4c66dcd84194.exe
Token: SeDebugPrivilege	4756	sihost.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

2ed2a1d6604afeaa681f4c66dcd84194.execmd.execmd.exe

description	pid	process	target process
PID 4732 wrote to memory of 1948	4732	2ed2a1d6604afeaa681f4c66dcd84194.exe	cmd.exe
PID 4732 wrote to memory of 1948	4732	2ed2a1d6604afeaa681f4c66dcd84194.exe	cmd.exe
PID 4732 wrote to memory of 1948	4732	2ed2a1d6604afeaa681f4c66dcd84194.exe	cmd.exe
PID 4732 wrote to memory of 2844	4732	2ed2a1d6604afeaa681f4c66dcd84194.exe	cmd.exe
PID 4732 wrote to memory of 2844	4732	2ed2a1d6604afeaa681f4c66dcd84194.exe	cmd.exe
PID 4732 wrote to memory of 2844	4732	2ed2a1d6604afeaa681f4c66dcd84194.exe	cmd.exe
PID 1948 wrote to memory of 736	1948	cmd.exe	schtasks.exe
PID 1948 wrote to memory of 736	1948	cmd.exe	schtasks.exe
PID 1948 wrote to memory of 736	1948	cmd.exe	schtasks.exe
PID 2844 wrote to memory of 1788	2844	cmd.exe	timeout.exe
PID 2844 wrote to memory of 1788	2844	cmd.exe	timeout.exe
PID 2844 wrote to memory of 1788	2844	cmd.exe	timeout.exe
PID 2844 wrote to memory of 4756	2844	cmd.exe	sihost.exe
PID 2844 wrote to memory of 4756	2844	cmd.exe	sihost.exe
PID 2844 wrote to memory of 4756	2844	cmd.exe	sihost.exe

C:\Users\Admin\AppData\Local\Temp\2ed2a1d6604afeaa681f4c66dcd84194.exe
"C:\Users\Admin\AppData\Local\Temp\2ed2a1d6604afeaa681f4c66dcd84194.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "sihost" /tr '"C:\Users\Admin\AppData\Roaming\sihost.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "sihost" /tr '"C:\Users\Admin\AppData\Roaming\sihost.exe"'
3⤵
- Creates scheduled task(s)
PID:736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFCFD.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1788

C:\Users\Admin\AppData\Roaming\sihost.exe
"C:\Users\Admin\AppData\Roaming\sihost.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFCFD.tmp.bat
Filesize
150B

MD5
97924420a20801327eb8875e331cd316

SHA1
f5e513d9c28557451a92ebef60bd17003fc80ef9

SHA256
d5bd5d145cf9967c4e88b40fecb25982e17fd40f64a47fee1ebddbd77abaab38

SHA512
f190bfca3c7fda70168afb54940e3465f54cde21d52c5954585505e23772684a6e5f43974ee468f33c41929d434f92b382c3e3fc5f1e9064e88fa92dade78174

Download Submit
C:\Users\Admin\AppData\Roaming\sihost.exe
Filesize
141KB

MD5
2ed2a1d6604afeaa681f4c66dcd84194

SHA1
6134d837220afe9377cd78950c8aca43dde08d8c

SHA256
2a48fa5118bf1c97de6a6b7b0a45bcc95bd678d54f31e2f2d003e5f3ea49c780

SHA512
b6dc02f1974d0d90b171432156b85044ab67b51c00c9a6f2ce98562342dd2afb64ac36ae57e291d37da0db564c7191567183917971455969d9eb930c920e8979

Download Submit
C:\Users\Admin\AppData\Roaming\sihost.exe
Filesize
141KB

MD5
2ed2a1d6604afeaa681f4c66dcd84194

SHA1
6134d837220afe9377cd78950c8aca43dde08d8c

SHA256
2a48fa5118bf1c97de6a6b7b0a45bcc95bd678d54f31e2f2d003e5f3ea49c780

SHA512
b6dc02f1974d0d90b171432156b85044ab67b51c00c9a6f2ce98562342dd2afb64ac36ae57e291d37da0db564c7191567183917971455969d9eb930c920e8979

Download Submit
memory/736-137-0x0000000000000000-mapping.dmp

Download
memory/1788-138-0x0000000000000000-mapping.dmp

Download
memory/1948-134-0x0000000000000000-mapping.dmp

Download
memory/2844-135-0x0000000000000000-mapping.dmp

Download
memory/4732-132-0x0000000000260000-0x000000000028A000-memory.dmp

Filesize
168KB

Download
memory/4732-133-0x000000000A2A0000-0x000000000A2BA000-memory.dmp

Filesize
104KB

Download
memory/4756-139-0x0000000000000000-mapping.dmp

Download
memory/4756-142-0x00000000050F0000-0x0000000005190000-memory.dmp

Filesize
640KB

Download
memory/4756-143-0x0000000007000000-0x000000000709C000-memory.dmp

Filesize
624KB

Download
memory/4756-144-0x0000000007B10000-0x00000000080B4000-memory.dmp

Filesize
5.6MB

Download
memory/4756-145-0x0000000006B40000-0x0000000006BA6000-memory.dmp

Filesize
408KB

Download
memory/4756-146-0x00000000050F0000-0x0000000005190000-memory.dmp

Filesize
640KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads