Analysis
- max time kernel
91s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
29/09/2022, 10:42
General
- Target c7d39b6c6e771ec9d3cdd77948f24a20.exe
- Size 76KB
- Sample220929-mrn6zsaec8
- SHA256 6356a834e1bcd90c400db0d5672e52dc531dcae7a79bc2bc8a77da0f61139a3b
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7d39b6c6e771ec9d3cdd77948f24a20.exe"C:\Users\Admin\AppData\Local\Temp\c7d39b6c6e771ec9d3cdd77948f24a20.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2924-136-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp
memory/2924-138-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp
memory/2924-139-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp
memory/4528-132-0x0000015B3EC70000-0x0000015B3EC88000-memory.dmp
memory/4528-133-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp
memory/4528-134-0x0000015B40960000-0x0000015B40982000-memory.dmp
memory/4528-137-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp
memory/4528-140-0x00007FF93BAB0000-0x00007FF93BCA5000-memory.dmp
memory/4528-142-0x0000015B592BA000-0x0000015B592BF000-memory.dmp
memory/4528-143-0x00007FF91DE10000-0x00007FF91E8D1000-memory.dmp
memory/4528-144-0x00007FF93BAB0000-0x00007FF93BCA5000-memory.dmp