2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231

Analysis

max time kernel
84s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
Size

35KB
MD5

73a28e35d84fb623b2bb7b5c946f230d
SHA1

5e7aaee6f9d9d78c8e1a335fef4fd7c3540c5b69
SHA256

2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231
SHA512

2d07c0c0ca3e29f73386e51d780f35e8854a9dc74d7c05c3d5cfcc67040de725127dcf86c5b758ea7e6aa98e8814e0668908580aa5e53ec152879561fc3fc866
SSDEEP

768:5Kgphok5Fvwh62at6oBa8F7mlXPw4AwySaEtVvwIioyPyYebfC:5KMfwM2ae8F78Pw4ASDVIIpyaxfC

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program files\MSDN\LHL13.sys	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
File created	C:\Program files\MSDN\000000001	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
File opened for modification	C:\Program files\MSDN\000000001	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
File created	C:\Program files\MSDN\hehex.sys	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
644	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
Token: SeDebugPrivilege	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
Token: SeDebugPrivilege	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 4600	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	83
PID 3428 wrote to memory of 4600	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	83
PID 3428 wrote to memory of 4600	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	83
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24
PID 3428 wrote to memory of 3048	3428	2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe	24

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3048
- C:\Users\Admin\AppData\Local\Temp\2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe
  "C:\Users\Admin\AppData\Local\Temp\2af4a9dc9dedf143149456fc9949c9dcad00fb63c13454238a292baac2c6f231.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c time 15:04:00
    3⤵
    PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\t.bat" "
    3⤵
    PID:2372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\t.bat

Filesize
252B

MD5
adba3ef4814ef91d7475d9e5068fba37

SHA1
b00a677e1809d22d0271b694bd16a19a868bfdc2

SHA256
4256c0f9a038c63343648c6eade6ec5449e45d83dfbb8133795d7cd4ded43f48

SHA512
a003452ab00324c9608ded632faef7aaf7e7241ca405042694f85badc4c4bf681e4127688d9ce4d17d9389ffe31d6804af290b99af2b18d43aa6a8f2eb179a30

Download Submit
memory/2372-133-0x0000000000000000-mapping.dmp

Download
memory/3428-132-0x00000000021C0000-0x00000000021C5000-memory.dmp

Filesize
20KB

Download