41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72

General

Target

41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
Size

10KB
MD5

df0c1062b69207999a01093275d9d1b0
SHA1

e3babe3de97cd12955ca8655506d551995cc58c0
SHA256

41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72
SHA512

2e0e0a729d0da6e737b64705c9d18c320b1888609f940a187c2d8732006923022150d497d81e58925f615dbdedc58a564e4b93dd940cdc07a00ec09a92ab6cec
SSDEEP

96:sRfBtVTqIdVe6G+TgJcrX4AaC6PDxicgh8TqtPn9Vltv15HNEB1P9Bqm9bFnU:SV7d8j+TgJ+EDIcgh8T2PnHXHgvBc

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
208	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
1692	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1192 set thread context of 3424	1192	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	80
PID 208 set thread context of 1692	208	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2876	powershell.exe
2876	powershell.exe
1692	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
1692	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
1692	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
1692	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
1692	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
1692	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
1692	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
1692	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
Token: SeDebugPrivilege	3424	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	208	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
Token: SeDebugPrivilege	1692	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 3424	1192	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	80
PID 1192 wrote to memory of 3424	1192	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	80
PID 1192 wrote to memory of 3424	1192	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	80
PID 1192 wrote to memory of 3424	1192	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	80
PID 1192 wrote to memory of 3424	1192	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	80
PID 1192 wrote to memory of 3424	1192	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	80
PID 3424 wrote to memory of 2876	3424	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	87
PID 3424 wrote to memory of 2876	3424	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	87
PID 208 wrote to memory of 1692	208	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	90
PID 208 wrote to memory of 1692	208	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	90
PID 208 wrote to memory of 1692	208	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	90
PID 208 wrote to memory of 1692	208	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	90
PID 208 wrote to memory of 1692	208	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	90
PID 208 wrote to memory of 1692	208	41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe	90

C:\Users\Admin\AppData\Local\Temp\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
"C:\Users\Admin\AppData\Local\Temp\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
  C:\Users\Admin\AppData\Local\Temp\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2876

C:\Users\Admin\AppData\Roaming\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
C:\Users\Admin\AppData\Roaming\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208
- C:\Users\Admin\AppData\Roaming\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
  C:\Users\Admin\AppData\Roaming\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe.log

Filesize
1KB

MD5
165bccf3bb1841eaf1a73ff52d65f59e

SHA1
8450f78886ff5ee9f0a1590582ed455624ae7eca

SHA256
d063952c091e25214469458e65b33da9ef9b413ede9cc2b8a5c28970bb1a5b69

SHA512
519d9ffd811bea83a16c234e25172ea186932c45b7004a309d536d0b3b465cc9c3409afc0fdf481fa215a395e305bbb5f2e209f6e0139875d710f23ff38fd5a4

Download Submit
C:\Users\Admin\AppData\Roaming\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe

Filesize
10KB

MD5
df0c1062b69207999a01093275d9d1b0

SHA1
e3babe3de97cd12955ca8655506d551995cc58c0

SHA256
41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72

SHA512
2e0e0a729d0da6e737b64705c9d18c320b1888609f940a187c2d8732006923022150d497d81e58925f615dbdedc58a564e4b93dd940cdc07a00ec09a92ab6cec

Download Submit
C:\Users\Admin\AppData\Roaming\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe

Filesize
10KB

MD5
df0c1062b69207999a01093275d9d1b0

SHA1
e3babe3de97cd12955ca8655506d551995cc58c0

SHA256
41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72

SHA512
2e0e0a729d0da6e737b64705c9d18c320b1888609f940a187c2d8732006923022150d497d81e58925f615dbdedc58a564e4b93dd940cdc07a00ec09a92ab6cec

Download Submit
C:\Users\Admin\AppData\Roaming\41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72.exe

Filesize
10KB

MD5
df0c1062b69207999a01093275d9d1b0

SHA1
e3babe3de97cd12955ca8655506d551995cc58c0

SHA256
41bc88d88e0e521e833308475539f3427edd5bb2f6966729605e8fe58901db72

SHA512
2e0e0a729d0da6e737b64705c9d18c320b1888609f940a187c2d8732006923022150d497d81e58925f615dbdedc58a564e4b93dd940cdc07a00ec09a92ab6cec

Download Submit
memory/208-146-0x00007FFF3CBB0000-0x00007FFF3D671000-memory.dmp

Filesize
10.8MB

Download
memory/208-151-0x00007FFF3CBB0000-0x00007FFF3D671000-memory.dmp

Filesize
10.8MB

Download
memory/1192-138-0x00007FFF3CBB0000-0x00007FFF3D671000-memory.dmp

Filesize
10.8MB

Download
memory/1192-133-0x00007FFF3CBB0000-0x00007FFF3D671000-memory.dmp

Filesize
10.8MB

Download
memory/1192-134-0x0000027AF2180000-0x0000027AF21A2000-memory.dmp

Filesize
136KB

Download
memory/1192-132-0x0000027AD7290000-0x0000027AD7296000-memory.dmp

Filesize
24KB

Download
memory/1692-154-0x00007FFF3CBB0000-0x00007FFF3D671000-memory.dmp

Filesize
10.8MB

Download
memory/1692-153-0x00007FFF3CBB0000-0x00007FFF3D671000-memory.dmp

Filesize
10.8MB

Download
memory/2876-142-0x00007FFF3CBB0000-0x00007FFF3D671000-memory.dmp

Filesize
10.8MB

Download
memory/2876-152-0x00007FFF3CBB0000-0x00007FFF3D671000-memory.dmp

Filesize
10.8MB

Download
memory/3424-145-0x00007FFF3CBB0000-0x00007FFF3D671000-memory.dmp

Filesize
10.8MB

Download
memory/3424-135-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3424-140-0x00007FFF3CBB0000-0x00007FFF3D671000-memory.dmp

Filesize
10.8MB

Download
memory/3424-139-0x00007FFF3CBB0000-0x00007FFF3D671000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing