4dfed4fe4bf83b2ef3c82c4468a3103953884257af9167f53be99dc5e3a66612

General

Target

N. 2022444___________________________________________________________________________________________png.exe
Size

13KB
MD5

a143a737e50b83645893a06100e02717
SHA1

4114ad06b295a2072b9d9eb4b031e936907d3804
SHA256

f330c3c357dc7e56276e70699142c1af47ad144d299c160d79e8aaa3e4018aa6
SHA512

a92b59233c0bc4bf23da1b298194f8eb7f4087c0e1be965d6dc9d13835da0284a8d24632927bb622832c693c55b69702ca8a80c115ff5ac3b6af0c32217092ba
SSDEEP

192:al5JJd1BbfVTjgIVC7LAXM/cTRy+SNB09QWN6UrwLk+:A5JJd1ZfVTjgnLym+pt5sg

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	N. 2022444___________________________________________________________________________________________png.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SISuXKF = "C:\\Users\\Admin\\AppData\\Roaming\\SISuXKF\\SISuXKF.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 692 set thread context of 3124	692	N. 2022444___________________________________________________________________________________________png.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3480	powershell.exe
3480	powershell.exe
692	N. 2022444___________________________________________________________________________________________png.exe
692	N. 2022444___________________________________________________________________________________________png.exe
692	N. 2022444___________________________________________________________________________________________png.exe
3124	MSBuild.exe
3124	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	N. 2022444___________________________________________________________________________________________png.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	3124	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3124	MSBuild.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 3480	692	N. 2022444___________________________________________________________________________________________png.exe	89
PID 692 wrote to memory of 3480	692	N. 2022444___________________________________________________________________________________________png.exe	89
PID 692 wrote to memory of 3480	692	N. 2022444___________________________________________________________________________________________png.exe	89
PID 692 wrote to memory of 4460	692	N. 2022444___________________________________________________________________________________________png.exe	101
PID 692 wrote to memory of 4460	692	N. 2022444___________________________________________________________________________________________png.exe	101
PID 692 wrote to memory of 4460	692	N. 2022444___________________________________________________________________________________________png.exe	101
PID 692 wrote to memory of 3124	692	N. 2022444___________________________________________________________________________________________png.exe	102
PID 692 wrote to memory of 3124	692	N. 2022444___________________________________________________________________________________________png.exe	102
PID 692 wrote to memory of 3124	692	N. 2022444___________________________________________________________________________________________png.exe	102
PID 692 wrote to memory of 3124	692	N. 2022444___________________________________________________________________________________________png.exe	102
PID 692 wrote to memory of 3124	692	N. 2022444___________________________________________________________________________________________png.exe	102
PID 692 wrote to memory of 3124	692	N. 2022444___________________________________________________________________________________________png.exe	102
PID 692 wrote to memory of 3124	692	N. 2022444___________________________________________________________________________________________png.exe	102
PID 692 wrote to memory of 3124	692	N. 2022444___________________________________________________________________________________________png.exe	102

C:\Users\Admin\AppData\Local\Temp\N. 2022444___________________________________________________________________________________________png.exe
"C:\Users\Admin\AppData\Local\Temp\N. 2022444___________________________________________________________________________________________png.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  PID:4460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-132-0x0000000000D50000-0x0000000000D5A000-memory.dmp

Filesize
40KB

Download
memory/692-133-0x0000000006350000-0x0000000006372000-memory.dmp

Filesize
136KB

Download
memory/692-143-0x0000000007470000-0x0000000007A14000-memory.dmp

Filesize
5.6MB

Download
memory/692-142-0x0000000006D70000-0x0000000006E02000-memory.dmp

Filesize
584KB

Download
memory/3124-148-0x0000000006030000-0x000000000603A000-memory.dmp

Filesize
40KB

Download
memory/3124-147-0x00000000052D0000-0x000000000536C000-memory.dmp

Filesize
624KB

Download
memory/3124-146-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3480-140-0x0000000007A10000-0x000000000808A000-memory.dmp

Filesize
6.5MB

Download
memory/3480-141-0x00000000066D0000-0x00000000066EA000-memory.dmp

Filesize
104KB

Download
memory/3480-139-0x00000000061E0000-0x00000000061FE000-memory.dmp

Filesize
120KB

Download
memory/3480-138-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Filesize
408KB

Download
memory/3480-137-0x00000000059F0000-0x0000000005A56000-memory.dmp

Filesize
408KB

Download
memory/3480-136-0x00000000052C0000-0x00000000058E8000-memory.dmp

Filesize
6.2MB

Download
memory/3480-135-0x0000000004C10000-0x0000000004C46000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing