f92d7bc5399737179cbb9e10fc5c083bcca2138881cddfdb7d7a4f6d7c5e3a96

Analysis

max time kernel
81s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2022 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file__escape_from_monkey_island_v1_1_zip__________.exe
Size

1.9MB
MD5

43959b593ea94d58856e4c1eff4dde03
SHA1

e3e850b622bc76c12872a9503197359759b4837f
SHA256

f92d7bc5399737179cbb9e10fc5c083bcca2138881cddfdb7d7a4f6d7c5e3a96
SHA512

afbfa94bfe05b039e34dd1b0eabf2d24f8043a188f7338f834ea39730ef294aa33c6a8277d85bb5e25be2b5c108be9bc806786d913238d75f49d8f700a8c7ba7
SSDEEP

24576:K7FUDowAyrTVE3U5FmJT72pQ0qr/ygA8XVKZzs29eo5x7awFhJdNo69lOy7KTiju:KBuZrEUAa3qrU8UZzs29555DdN7POGju

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3024	file__escape_from_monkey_island_v1_1_zip__________.tmp
5080	file__escape_from_monkey_island_v1_1_zip__________.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	file__escape_from_monkey_island_v1_1_zip__________.tmp

Loads dropped DLL 2 IoCs

pid	Process
3024	file__escape_from_monkey_island_v1_1_zip__________.tmp
5080	file__escape_from_monkey_island_v1_1_zip__________.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	217.160.70.42

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5080 set thread context of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PC_installer\unins000.dat	file__escape_from_monkey_island_v1_1_zip__________.tmp
File created	C:\Program Files (x86)\PC_installer\is-IEC40.tmp	file__escape_from_monkey_island_v1_1_zip__________.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3820	400	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5080	file__escape_from_monkey_island_v1_1_zip__________.tmp
5080	file__escape_from_monkey_island_v1_1_zip__________.tmp
5080	file__escape_from_monkey_island_v1_1_zip__________.tmp
5080	file__escape_from_monkey_island_v1_1_zip__________.tmp
5080	file__escape_from_monkey_island_v1_1_zip__________.tmp
5080	file__escape_from_monkey_island_v1_1_zip__________.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5080	file__escape_from_monkey_island_v1_1_zip__________.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3024	2440	file__escape_from_monkey_island_v1_1_zip__________.exe	80
PID 2440 wrote to memory of 3024	2440	file__escape_from_monkey_island_v1_1_zip__________.exe	80
PID 2440 wrote to memory of 3024	2440	file__escape_from_monkey_island_v1_1_zip__________.exe	80
PID 3024 wrote to memory of 5116	3024	file__escape_from_monkey_island_v1_1_zip__________.tmp	81
PID 3024 wrote to memory of 5116	3024	file__escape_from_monkey_island_v1_1_zip__________.tmp	81
PID 3024 wrote to memory of 5116	3024	file__escape_from_monkey_island_v1_1_zip__________.tmp	81
PID 5116 wrote to memory of 5080	5116	file__escape_from_monkey_island_v1_1_zip__________.exe	82
PID 5116 wrote to memory of 5080	5116	file__escape_from_monkey_island_v1_1_zip__________.exe	82
PID 5116 wrote to memory of 5080	5116	file__escape_from_monkey_island_v1_1_zip__________.exe	82
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89
PID 5080 wrote to memory of 400	5080	file__escape_from_monkey_island_v1_1_zip__________.tmp	89

C:\Users\Admin\AppData\Local\Temp\file__escape_from_monkey_island_v1_1_zip__________.exe
"C:\Users\Admin\AppData\Local\Temp\file__escape_from_monkey_island_v1_1_zip__________.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\is-H4ITA.tmp\file__escape_from_monkey_island_v1_1_zip__________.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-H4ITA.tmp\file__escape_from_monkey_island_v1_1_zip__________.tmp" /SL5="$C01CC,1133529,832512,C:\Users\Admin\AppData\Local\Temp\file__escape_from_monkey_island_v1_1_zip__________.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\file__escape_from_monkey_island_v1_1_zip__________.exe
    "C:\Users\Admin\AppData\Local\Temp\file__escape_from_monkey_island_v1_1_zip__________.exe" /VERYSILENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\is-EMR7N.tmp\file__escape_from_monkey_island_v1_1_zip__________.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-EMR7N.tmp\file__escape_from_monkey_island_v1_1_zip__________.tmp" /SL5="$D01CC,1133529,832512,C:\Users\Admin\AppData\Local\Temp\file__escape_from_monkey_island_v1_1_zip__________.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe 92
        5⤵
        
        PID:400
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 504
        6⤵
        Program crash
        
        PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 400 -ip 400
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-EMR7N.tmp\file__escape_from_monkey_island_v1_1_zip__________.tmp

Filesize
3.0MB

MD5
9c08f2d5fdf75be4e245de2af327aad0

SHA1
35531017bc790ad3e24d61679ed49e0a8e2502b6

SHA256
7f40052235be5183353f51ca74d2c76f16db1e6ec3fe3fcbc37b345a7aa2a7b0

SHA512
06f682ca37697cc0758a3204be765380decd9c647a72899488c8a4ca849f8b03778417c470bc1bfa45492b16733d7f0c9ae04307bd9bee997f0605e13cd68147

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EMR7N.tmp\file__escape_from_monkey_island_v1_1_zip__________.tmp

Filesize
3.0MB

MD5
9c08f2d5fdf75be4e245de2af327aad0

SHA1
35531017bc790ad3e24d61679ed49e0a8e2502b6

SHA256
7f40052235be5183353f51ca74d2c76f16db1e6ec3fe3fcbc37b345a7aa2a7b0

SHA512
06f682ca37697cc0758a3204be765380decd9c647a72899488c8a4ca849f8b03778417c470bc1bfa45492b16733d7f0c9ae04307bd9bee997f0605e13cd68147

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H4ITA.tmp\file__escape_from_monkey_island_v1_1_zip__________.tmp

Filesize
3.0MB

MD5
9c08f2d5fdf75be4e245de2af327aad0

SHA1
35531017bc790ad3e24d61679ed49e0a8e2502b6

SHA256
7f40052235be5183353f51ca74d2c76f16db1e6ec3fe3fcbc37b345a7aa2a7b0

SHA512
06f682ca37697cc0758a3204be765380decd9c647a72899488c8a4ca849f8b03778417c470bc1bfa45492b16733d7f0c9ae04307bd9bee997f0605e13cd68147

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IP32I.tmp\service.dll

Filesize
369KB

MD5
d20aed9970a8a87451a22a96835dcda6

SHA1
dcfd841248beb26c01ddffefbd9175d5807ab758

SHA256
8d4f2a0ffccbb87f22d22623187a62e17f9236280b31af7b6a0d8632760433fd

SHA512
8f7d0004d83001e6d0ce0ab1536eae2f733f3973194947c2c152202298e09d4ac594defe2e7f7a86a85dae43cf8a7cacbbb673abeac091461c2a8dc306f3d675

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VPBDA.tmp\service.dll

Filesize
369KB

MD5
d20aed9970a8a87451a22a96835dcda6

SHA1
dcfd841248beb26c01ddffefbd9175d5807ab758

SHA256
8d4f2a0ffccbb87f22d22623187a62e17f9236280b31af7b6a0d8632760433fd

SHA512
8f7d0004d83001e6d0ce0ab1536eae2f733f3973194947c2c152202298e09d4ac594defe2e7f7a86a85dae43cf8a7cacbbb673abeac091461c2a8dc306f3d675

Download Submit
memory/400-150-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/400-147-0x0000000000000000-mapping.dmp

Download
memory/400-152-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/400-149-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/400-148-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/2440-132-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2440-142-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2440-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3024-135-0x0000000000000000-mapping.dmp

Download
memory/5080-143-0x0000000000000000-mapping.dmp

Download
memory/5080-151-0x0000000000AA7000-0x0000000000AE2000-memory.dmp

Filesize
236KB

Download
memory/5080-154-0x0000000000AA7000-0x0000000000AE2000-memory.dmp

Filesize
236KB

Download
memory/5116-146-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5116-138-0x0000000000000000-mapping.dmp

Download
memory/5116-140-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download