7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170

General

Target

7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe
Size

60KB
MD5

52aa50b65dc1945810ad85fe5b6d9def
SHA1

4acfc60501c028149ca2ff07e9ace3c69c205b0a
SHA256

7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170
SHA512

b02cb0b33747f893ce81f7d7b7d475759b182b2356feb1680b3ea9d8147c936eb2375034ae556d5da2220f8284b2ee632c865faf6ba249c11ac58a4c98ad6256
SSDEEP

1536:PQDzb+9Z4YrbuPfrqc80CXI5uQ5cd7+LX0+X+saESQk1H8D:YviL7X0Tqc8ZXI3uFWXpnalBH6

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4848	srzhost.exe
4640	srzhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\srzhost = "C:\\Windows\\system32\\srzhost.exe"	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\srzhost.exe	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe
File opened for modification	C:\Windows\SysWOW64\srzhost.exe	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe
File created	C:\Windows\SysWOW64\srzhost.exe	srzhost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1596 set thread context of 4444	1596	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe	80
PID 4848 set thread context of 4640	4848	srzhost.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 4444	1596	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe	80
PID 1596 wrote to memory of 4444	1596	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe	80
PID 1596 wrote to memory of 4444	1596	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe	80
PID 1596 wrote to memory of 4444	1596	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe	80
PID 1596 wrote to memory of 4444	1596	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe	80
PID 4444 wrote to memory of 4848	4444	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe	81
PID 4444 wrote to memory of 4848	4444	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe	81
PID 4444 wrote to memory of 4848	4444	7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe	81
PID 4848 wrote to memory of 4640	4848	srzhost.exe	82
PID 4848 wrote to memory of 4640	4848	srzhost.exe	82
PID 4848 wrote to memory of 4640	4848	srzhost.exe	82
PID 4848 wrote to memory of 4640	4848	srzhost.exe	82
PID 4848 wrote to memory of 4640	4848	srzhost.exe	82

C:\Users\Admin\AppData\Local\Temp\7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe
"C:\Users\Admin\AppData\Local\Temp\7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe
  C:\Users\Admin\AppData\Local\Temp\7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170.exe
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\srzhost.exe
    "C:\Windows\system32\srzhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\SysWOW64\srzhost.exe
      C:\Windows\SysWOW64\srzhost.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\srzhost.exe

Filesize
60KB

MD5
52aa50b65dc1945810ad85fe5b6d9def

SHA1
4acfc60501c028149ca2ff07e9ace3c69c205b0a

SHA256
7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170

SHA512
b02cb0b33747f893ce81f7d7b7d475759b182b2356feb1680b3ea9d8147c936eb2375034ae556d5da2220f8284b2ee632c865faf6ba249c11ac58a4c98ad6256

Download Submit
C:\Windows\SysWOW64\srzhost.exe

Filesize
60KB

MD5
52aa50b65dc1945810ad85fe5b6d9def

SHA1
4acfc60501c028149ca2ff07e9ace3c69c205b0a

SHA256
7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170

SHA512
b02cb0b33747f893ce81f7d7b7d475759b182b2356feb1680b3ea9d8147c936eb2375034ae556d5da2220f8284b2ee632c865faf6ba249c11ac58a4c98ad6256

Download Submit
C:\Windows\SysWOW64\srzhost.exe

Filesize
60KB

MD5
52aa50b65dc1945810ad85fe5b6d9def

SHA1
4acfc60501c028149ca2ff07e9ace3c69c205b0a

SHA256
7112a63900deba925fca273de203be9555acbfe4074f8f618d9b2144db8d3170

SHA512
b02cb0b33747f893ce81f7d7b7d475759b182b2356feb1680b3ea9d8147c936eb2375034ae556d5da2220f8284b2ee632c865faf6ba249c11ac58a4c98ad6256

Download Submit
memory/4444-135-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4444-136-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4444-132-0x0000000000000000-mapping.dmp

Download
memory/4444-134-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4444-140-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4444-133-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4640-141-0x0000000000000000-mapping.dmp

Download
memory/4640-144-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4640-145-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4640-146-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4848-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing