Analysis
- max time kernel
139s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
21/09/2022, 06:17
General
- Target 5589c07b336229bd2dea6454fdd3b021.exe
- Size 245KB
- Sample220921-g12wjsfed3
- SHA256 91af42153fd29d18e2983570aa5d627a7c7eef9c80c330a0acebb89fd6a2ba41
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5589c07b336229bd2dea6454fdd3b021.exe"C:\Users\Admin\AppData\Local\Temp\5589c07b336229bd2dea6454fdd3b021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5589c07b336229bd2dea6454fdd3b021.exeC:\Users\Admin\AppData\Local\Temp\5589c07b336229bd2dea6454fdd3b021.exe2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\5589c07b336229bd2dea6454fdd3b021.exeC:\Users\Admin\AppData\Roaming\5589c07b336229bd2dea6454fdd3b021.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\5589c07b336229bd2dea6454fdd3b021.exeC:\Users\Admin\AppData\Roaming\5589c07b336229bd2dea6454fdd3b021.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHcAbQBEAEkAUABlAC4AZQB4AGUAIgA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wmDIPe.exe"C:\Users\Admin\AppData\Local\Temp\wmDIPe.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
5589c07b336229bd2dea6454fdd3b021.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
wmDIPe.exe
wmDIPe.exe
5589c07b336229bd2dea6454fdd3b021.exe
5589c07b336229bd2dea6454fdd3b021.exe
5589c07b336229bd2dea6454fdd3b021.exe
memory/1340-141-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/1340-146-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/1340-140-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/1340-136-0x0000000000400000-0x000000000048C000-memory.dmp
memory/1444-170-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/1444-168-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/2116-169-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/2116-165-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/2116-163-0x0000014227FA0000-0x000001422824A000-memory.dmp
memory/2404-164-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/2404-159-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/3304-133-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/3304-139-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/3304-132-0x0000018A33EF0000-0x0000018A33F32000-memory.dmp
memory/3304-135-0x0000018A4F4A0000-0x0000018A4F4C2000-memory.dmp
memory/3304-134-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/3752-148-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/3752-143-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/4608-155-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/4608-154-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/5116-149-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/5116-153-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp
memory/5116-147-0x00007FFFC9CB0000-0x00007FFFCA771000-memory.dmp