389c8fd9a0090d7654515d0db606a2e2e3f4ae1721797a16ddc4fbded262c6d5

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2022, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64079a8dca245ddcfe047d0fd0c96ad0.exe
Size 245KB
Sample220921-g2ms1sfed7
SHA256 389c8fd9a0090d7654515d0db606a2e2e3f4ae1721797a16ddc4fbded262c6d5
MD5 64079a8dca245ddcfe047d0fd0c96ad0
SHA1 889738fbf41625f7304ca7f2dbfa3ebb22b543b6
SHA512 843035bd1fcfec5b608db1e34ff2109d8d4a0a75b9d1277cfe585ddf080f6bda9dac4e78940c54ffcf97dc041162d09e6e60d4d3391725c4494dec68661223eb
SSDEEP 384:BNCLq1Z1kFXP4WGzvsuj8Sf5dCuEMa/qunCmtJdh5R555Di:BN+IZ1s6bdCjquRr5R555W
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3548	64079a8dca245ddcfe047d0fd0c96ad0.exe
3252	64079a8dca245ddcfe047d0fd0c96ad0.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	64079a8dca245ddcfe047d0fd0c96ad0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	64079a8dca245ddcfe047d0fd0c96ad0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	64079a8dca245ddcfe047d0fd0c96ad0.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2568 set thread context of 4492	2568	64079a8dca245ddcfe047d0fd0c96ad0.exe	85
PID 3548 set thread context of 3252	3548	64079a8dca245ddcfe047d0fd0c96ad0.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4748	powershell.exe
4748	powershell.exe
2784	powershell.exe
2784	powershell.exe
2340	powershell.exe
2340	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	64079a8dca245ddcfe047d0fd0c96ad0.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	4492	64079a8dca245ddcfe047d0fd0c96ad0.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	3548	64079a8dca245ddcfe047d0fd0c96ad0.exe
Token: SeDebugPrivilege	2340	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4748	2568	64079a8dca245ddcfe047d0fd0c96ad0.exe	82
PID 2568 wrote to memory of 4748	2568	64079a8dca245ddcfe047d0fd0c96ad0.exe	82
PID 2568 wrote to memory of 4492	2568	64079a8dca245ddcfe047d0fd0c96ad0.exe	85
PID 2568 wrote to memory of 4492	2568	64079a8dca245ddcfe047d0fd0c96ad0.exe	85
PID 2568 wrote to memory of 4492	2568	64079a8dca245ddcfe047d0fd0c96ad0.exe	85
PID 2568 wrote to memory of 4492	2568	64079a8dca245ddcfe047d0fd0c96ad0.exe	85
PID 2568 wrote to memory of 4492	2568	64079a8dca245ddcfe047d0fd0c96ad0.exe	85
PID 2568 wrote to memory of 4492	2568	64079a8dca245ddcfe047d0fd0c96ad0.exe	85
PID 4492 wrote to memory of 2784	4492	64079a8dca245ddcfe047d0fd0c96ad0.exe	92
PID 4492 wrote to memory of 2784	4492	64079a8dca245ddcfe047d0fd0c96ad0.exe	92
PID 3548 wrote to memory of 2340	3548	64079a8dca245ddcfe047d0fd0c96ad0.exe	95
PID 3548 wrote to memory of 2340	3548	64079a8dca245ddcfe047d0fd0c96ad0.exe	95
PID 3548 wrote to memory of 3252	3548	64079a8dca245ddcfe047d0fd0c96ad0.exe	97
PID 3548 wrote to memory of 3252	3548	64079a8dca245ddcfe047d0fd0c96ad0.exe	97
PID 3548 wrote to memory of 3252	3548	64079a8dca245ddcfe047d0fd0c96ad0.exe	97
PID 3548 wrote to memory of 3252	3548	64079a8dca245ddcfe047d0fd0c96ad0.exe	97
PID 3548 wrote to memory of 3252	3548	64079a8dca245ddcfe047d0fd0c96ad0.exe	97
PID 3548 wrote to memory of 3252	3548	64079a8dca245ddcfe047d0fd0c96ad0.exe	97

C:\Users\Admin\AppData\Local\Temp\64079a8dca245ddcfe047d0fd0c96ad0.exe
"C:\Users\Admin\AppData\Local\Temp\64079a8dca245ddcfe047d0fd0c96ad0.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Users\Admin\AppData\Local\Temp\64079a8dca245ddcfe047d0fd0c96ad0.exe
  C:\Users\Admin\AppData\Local\Temp\64079a8dca245ddcfe047d0fd0c96ad0.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2784

C:\Users\Admin\AppData\Roaming\64079a8dca245ddcfe047d0fd0c96ad0.exe
C:\Users\Admin\AppData\Roaming\64079a8dca245ddcfe047d0fd0c96ad0.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Users\Admin\AppData\Roaming\64079a8dca245ddcfe047d0fd0c96ad0.exe
  C:\Users\Admin\AppData\Roaming\64079a8dca245ddcfe047d0fd0c96ad0.exe
  2⤵
  - Executes dropped EXE
  PID:3252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64079a8dca245ddcfe047d0fd0c96ad0.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\64079a8dca245ddcfe047d0fd0c96ad0.exe.log
Size 1KB
SHA256 d063952c091e25214469458e65b33da9ef9b413ede9cc2b8a5c28970bb1a5b69
MD5 165bccf3bb1841eaf1a73ff52d65f59e
SHA1 8450f78886ff5ee9f0a1590582ed455624ae7eca
SHA512 519d9ffd811bea83a16c234e25172ea186932c45b7004a309d536d0b3b465cc9c3409afc0fdf481fa215a395e305bbb5f2e209f6e0139875d710f23ff38fd5a4
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 78d612ffa268c2871faf8e656889f9ec6475890ff2763410dbf434a343ad9a0d
MD5 2f996b44e71bcf8e9d9bd5ef2a96a963
SHA1 61a10fcfb7bad1271f7132c7491982a916489af0
SHA512 84815d678a672aa99d4834fa4c0a42089bec36da593caabc337dc66180a8ebd0131e65fb68ba645d3d68e80a5e7808e0dcf5b0ff1cb2a46786d532b088b44515
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a37443cc081c1271d48571adeb3957aac19db78813c9e33030408e36a42920f7
MD5 6daf0ffb770b03e94a5a74b48a306793
SHA1 192e8f9ea24c1c810928ca4f81c18857200cf6ed
SHA512 51d164b935aec3e3598d0a9175862e628f9ebc60c53c2bc182236cb1f6048239c711a95fcff9e4bad9e27d9a8fa3770ffd54ea0ddfcc6962d4f5b1e86723b405
MD5 SHA1 SHA512

Submit Download

64079a8dca245ddcfe047d0fd0c96ad0.exe

Path C:\Users\Admin\AppData\Roaming\64079a8dca245ddcfe047d0fd0c96ad0.exe
Size 245KB
SHA256 389c8fd9a0090d7654515d0db606a2e2e3f4ae1721797a16ddc4fbded262c6d5
MD5 64079a8dca245ddcfe047d0fd0c96ad0
SHA1 889738fbf41625f7304ca7f2dbfa3ebb22b543b6
SHA512 843035bd1fcfec5b608db1e34ff2109d8d4a0a75b9d1277cfe585ddf080f6bda9dac4e78940c54ffcf97dc041162d09e6e60d4d3391725c4494dec68661223eb
SSDEEP 384:BNCLq1Z1kFXP4WGzvsuj8Sf5dCuEMa/qunCmtJdh5R555Di:BN+IZ1s6bdCjquRr5R555W
MD5 SHA1 SHA512 SSDEEP

Submit Download

64079a8dca245ddcfe047d0fd0c96ad0.exe

Path C:\Users\Admin\AppData\Roaming\64079a8dca245ddcfe047d0fd0c96ad0.exe
Size 245KB
SHA256 389c8fd9a0090d7654515d0db606a2e2e3f4ae1721797a16ddc4fbded262c6d5
MD5 64079a8dca245ddcfe047d0fd0c96ad0
SHA1 889738fbf41625f7304ca7f2dbfa3ebb22b543b6
SHA512 843035bd1fcfec5b608db1e34ff2109d8d4a0a75b9d1277cfe585ddf080f6bda9dac4e78940c54ffcf97dc041162d09e6e60d4d3391725c4494dec68661223eb
SSDEEP 384:BNCLq1Z1kFXP4WGzvsuj8Sf5dCuEMa/qunCmtJdh5R555Di:BN+IZ1s6bdCjquRr5R555W
MD5 SHA1 SHA512 SSDEEP

Submit Download

64079a8dca245ddcfe047d0fd0c96ad0.exe

Path C:\Users\Admin\AppData\Roaming\64079a8dca245ddcfe047d0fd0c96ad0.exe
Size 245KB
SHA256 389c8fd9a0090d7654515d0db606a2e2e3f4ae1721797a16ddc4fbded262c6d5
MD5 64079a8dca245ddcfe047d0fd0c96ad0
SHA1 889738fbf41625f7304ca7f2dbfa3ebb22b543b6
SHA512 843035bd1fcfec5b608db1e34ff2109d8d4a0a75b9d1277cfe585ddf080f6bda9dac4e78940c54ffcf97dc041162d09e6e60d4d3391725c4494dec68661223eb
SSDEEP 384:BNCLq1Z1kFXP4WGzvsuj8Sf5dCuEMa/qunCmtJdh5R555Di:BN+IZ1s6bdCjquRr5R555W
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2340-160-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/2340-159-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/2340-158-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/2568-135-0x000001C9D3250000-0x000001C9D3272000-memory.dmp

Download

memory/2568-133-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/2568-143-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/2568-134-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/2568-132-0x000001C9B7E90000-0x000001C9B7ED2000-memory.dmp

Download

memory/2784-152-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/2784-154-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/3548-155-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/3548-153-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/3548-164-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/4492-151-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/4492-140-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/4492-145-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/4492-144-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/4748-138-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/4748-139-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download

memory/4748-137-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Download