Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe
Resource
win10v2004-20220812-en
General
-
Target
7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe
-
Size
264KB
-
MD5
8a76938eac3960939b0d96caad0ca670
-
SHA1
51d1aa88fde35179946498085c25f46edd9962c3
-
SHA256
7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d
-
SHA512
94912e8bfaca344c52c953539e289d0758c5727c56b90270ec6e88b95124613b57f5880e010861998bc9574eb4b5299d2e5425a28ba4b6a99ab6bd491fad5d57
-
SSDEEP
3072:b1dlKwgj23+Oz05YoNozDv4Vh97i4Liu5Z611359z9pN7qJtt7KrbX4Zb8P8o1w5:b1dlZro5yDAV1iuLQ3tN7q1c8+PVB0Z
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2256 s1a4a.exe 3588 s1a4a.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2256 set thread context of 3588 2256 s1a4a.exe 81 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Extracted\æLoQ‰²ªFȵӂ=|ä¤\LÝoÅ †Š'“,8N9’ \Eò,\"¤3܆ʄʄBDÛ, uŽõ4ÔÄwýïK©Â£'›³²HN j{œUr9È›T¦ZjQÅæeh™’K,ãÚ*ê3¨£G"C®#Ø÷k¼^¬[h‚ë΂$Jš™í]к¹¹‘)Ttõµb]d••Ç"ó†îŽZøž=Àu2e}\k»Rájƒ|:Ê·,…«ëXÿ 7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3588 s1a4a.exe 3588 s1a4a.exe 3588 s1a4a.exe 3588 s1a4a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2256 s1a4a.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4824 wrote to memory of 2256 4824 7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe 80 PID 4824 wrote to memory of 2256 4824 7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe 80 PID 4824 wrote to memory of 2256 4824 7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe 80 PID 2256 wrote to memory of 3588 2256 s1a4a.exe 81 PID 2256 wrote to memory of 3588 2256 s1a4a.exe 81 PID 2256 wrote to memory of 3588 2256 s1a4a.exe 81 PID 2256 wrote to memory of 3588 2256 s1a4a.exe 81 PID 2256 wrote to memory of 3588 2256 s1a4a.exe 81 PID 2256 wrote to memory of 3588 2256 s1a4a.exe 81 PID 2256 wrote to memory of 3588 2256 s1a4a.exe 81 PID 3588 wrote to memory of 2976 3588 s1a4a.exe 41 PID 3588 wrote to memory of 2976 3588 s1a4a.exe 41 PID 3588 wrote to memory of 2976 3588 s1a4a.exe 41 PID 3588 wrote to memory of 2976 3588 s1a4a.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe"C:\Users\Admin\AppData\Local\Temp\7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe"1⤵
- Checks computer location settings
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Extracted\s1a4a.exe"C:\Extracted\s1a4a.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Extracted\s1a4a.exeC:\Extracted\s1a4a.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3588
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2976
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD5ae9e89e9eef61cb8225e451f03e6dbaf
SHA128e86646bc4ca8fb7eca376bf6fc1437e7703a39
SHA256c262f836d430743c0c1a1dfba4f8f1da376b95a8d1cf1a632c8cdd8d31b6ee76
SHA512fb55f6779f695862ec680986f61b3536b67693eba2af48b6124215916b7e0f2ddb1db8cdd085ed1c8f979282a147862d357d3b9c803ec03a5dc004463f87c5ba
-
Filesize
200KB
MD5ae9e89e9eef61cb8225e451f03e6dbaf
SHA128e86646bc4ca8fb7eca376bf6fc1437e7703a39
SHA256c262f836d430743c0c1a1dfba4f8f1da376b95a8d1cf1a632c8cdd8d31b6ee76
SHA512fb55f6779f695862ec680986f61b3536b67693eba2af48b6124215916b7e0f2ddb1db8cdd085ed1c8f979282a147862d357d3b9c803ec03a5dc004463f87c5ba
-
Filesize
200KB
MD5ae9e89e9eef61cb8225e451f03e6dbaf
SHA128e86646bc4ca8fb7eca376bf6fc1437e7703a39
SHA256c262f836d430743c0c1a1dfba4f8f1da376b95a8d1cf1a632c8cdd8d31b6ee76
SHA512fb55f6779f695862ec680986f61b3536b67693eba2af48b6124215916b7e0f2ddb1db8cdd085ed1c8f979282a147862d357d3b9c803ec03a5dc004463f87c5ba