9cd3e493e25dfb86a8e0a80be3734072f3401e67a45e65109262fef40d40cff2

Analysis

max time kernel
147s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2022, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO383330.exe
Size 752KB
Sample220805-pt2wzaadhj
SHA256 9cd3e493e25dfb86a8e0a80be3734072f3401e67a45e65109262fef40d40cff2
MD5 0cac41e28272381a91564b62d9d8cc6b
SHA1 47e55ab1c07f7a5f9bda93e7df70ca0bb3c8c1e9
SHA512 4688da3c7cffdb18c3ec955800ebbb09ee54b3f33237c80b5e7e9373b4674599a714675a49c286a4e6e37836253f2d498ac38ac939b9577c65feb4f4f8565971
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
63	1832	cmd.exe
68	1832	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	PO383330.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 2824	2244	PO383330.exe	100
PID 2824 set thread context of 2196	2824	PO383330.exe	43
PID 1832 set thread context of 2196	1832	cmd.exe	43

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2824	PO383330.exe
2824	PO383330.exe
2824	PO383330.exe
2824	PO383330.exe
2824	PO383330.exe
2824	PO383330.exe
2824	PO383330.exe
2824	PO383330.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe
1832	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2196	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2824	PO383330.exe
2824	PO383330.exe
2824	PO383330.exe
1832	cmd.exe
1832	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	PO383330.exe
Token: SeDebugPrivilege	1832	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2824	2244	PO383330.exe	100
PID 2244 wrote to memory of 2824	2244	PO383330.exe	100
PID 2244 wrote to memory of 2824	2244	PO383330.exe	100
PID 2244 wrote to memory of 2824	2244	PO383330.exe	100
PID 2244 wrote to memory of 2824	2244	PO383330.exe	100
PID 2244 wrote to memory of 2824	2244	PO383330.exe	100
PID 2196 wrote to memory of 1832	2196	Explorer.EXE	109
PID 2196 wrote to memory of 1832	2196	Explorer.EXE	109
PID 2196 wrote to memory of 1832	2196	Explorer.EXE	109

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\PO383330.exe
  "C:\Users\Admin\AppData\Local\Temp\PO383330.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Users\Admin\AppData\Local\Temp\PO383330.exe
    "C:\Users\Admin\AppData\Local\Temp\PO383330.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:3704
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1940
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1528
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4576
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1496
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2076
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4500
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-149-0x0000000000700000-0x000000000072D000-memory.dmp

Download

memory/1832-147-0x0000000000F70000-0x0000000001000000-memory.dmp

Download

memory/1832-146-0x0000000000700000-0x000000000072D000-memory.dmp

Download

memory/1832-145-0x0000000001120000-0x000000000146A000-memory.dmp

Download

memory/1832-144-0x00000000007C0000-0x000000000081A000-memory.dmp

Download

memory/2196-141-0x0000000007D30000-0x0000000007ED7000-memory.dmp

Download

memory/2196-150-0x0000000007EE0000-0x0000000008033000-memory.dmp

Download

memory/2196-148-0x0000000007EE0000-0x0000000008033000-memory.dmp

Download

memory/2244-135-0x000000000B9C0000-0x000000000BA26000-memory.dmp

Download

memory/2244-130-0x0000000000EC0000-0x0000000000F82000-memory.dmp

Download

memory/2244-134-0x000000000B820000-0x000000000B8BC000-memory.dmp

Download

memory/2244-133-0x00000000059D0000-0x00000000059DA000-memory.dmp

Download

memory/2244-132-0x0000000005920000-0x00000000059B2000-memory.dmp

Download

memory/2244-131-0x0000000005FF0000-0x0000000006594000-memory.dmp

Download

memory/2824-140-0x0000000001000000-0x0000000001011000-memory.dmp

Download

memory/2824-139-0x00000000014A0000-0x00000000017EA000-memory.dmp

Download

memory/2824-143-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/2824-137-0x0000000000400000-0x000000000042D000-memory.dmp

Download