fdbdb566dabed7e26f4888cabb7c9230e96bea7f6bb44bd570ba87efc0368099

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2022 12:08

Target

Stub/stub.exe
Size

1.5MB
MD5

cd57f9b56a059ce65666c2ee267f1f2a
SHA1

e1c2e55dfcacf1605fa3f75b81d05bde25986aa6
SHA256

f74dc7d939e1a44cd57d25d28e57c41a95e7080098bc1b37118ef8f51f6e2e36
SHA512

fa91e2b2bbddd9016d9f02dc6db33482aa3707db1596236f5cbe00837ba87926801f1ff1ce302e6eb3e2ad0fa8a528e7a9256e34ca1ee2249d6ef12c17d8408d

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

stub.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation stub.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3412 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2560 taskkill.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

stub.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 4336 stub.exe
Token: SeDebugPrivilege 2560 taskkill.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	stub.exe

pid	process
3412	timeout.exe

pid	process
2560	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	4336	stub.exe
Token: SeDebugPrivilege	2560	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

stub.execmd.exe

description	pid	process	target process
PID 4336 wrote to memory of 4764	4336	stub.exe	cmd.exe
PID 4336 wrote to memory of 4764	4336	stub.exe	cmd.exe
PID 4336 wrote to memory of 4764	4336	stub.exe	cmd.exe
PID 4764 wrote to memory of 5104	4764	cmd.exe	chcp.com
PID 4764 wrote to memory of 5104	4764	cmd.exe	chcp.com
PID 4764 wrote to memory of 5104	4764	cmd.exe	chcp.com
PID 4764 wrote to memory of 2560	4764	cmd.exe	taskkill.exe
PID 4764 wrote to memory of 2560	4764	cmd.exe	taskkill.exe
PID 4764 wrote to memory of 2560	4764	cmd.exe	taskkill.exe
PID 4764 wrote to memory of 3412	4764	cmd.exe	timeout.exe
PID 4764 wrote to memory of 3412	4764	cmd.exe	timeout.exe
PID 4764 wrote to memory of 3412	4764	cmd.exe	timeout.exe

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7261.tmp.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak
3⤵
- Delays execution with timeout.exe
PID:3412

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Local\Temp\tmp7261.tmp.bat
Filesize
57B

MD5
0b6934d545ba56aa213b488168ae6d58

SHA1
273859022b9bc6f2de345f05453fd31e5ec5b931

SHA256
0237cbf99c231e838b937de6c589424352c8d8e4499e291ba42ca1e3fca0be20

SHA512
b9b660f40adbcb5beb7b0b9024ae770493dfddd2493eba05a9b7973d1b797ff98142324b5bec40cd7d266eb734f0566ed81ffa92940a0a3d4c5f4217a0ad49a9

Download Submit
memory/2560-137-0x0000000000000000-mapping.dmp

Download
memory/3412-138-0x0000000000000000-mapping.dmp

Download
memory/4336-132-0x0000000000E20000-0x0000000000FA4000-memory.dmp

Filesize
1.5MB

Download
memory/4336-133-0x00000000058F0000-0x0000000005956000-memory.dmp

Filesize
408KB

Download
memory/4764-134-0x0000000000000000-mapping.dmp

Download
memory/5104-136-0x0000000000000000-mapping.dmp

Download