Analysis
-
max time kernel
185s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 22:44
Static task
static1
Behavioral task
behavioral1
Sample
5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exe
Resource
win10v2004-20220812-en
General
-
Target
5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exe
-
Size
992KB
-
MD5
6dc2a156ed306ff8b99894acc82b6b1c
-
SHA1
43277d449d307a8aa3108c26b1fd7fb3625b8606
-
SHA256
5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650
-
SHA512
c3ec20982f96432df6ab375db1b4cab441865351c5f13b43a20e7c231ab7673d2321134dca5eb4170d8f77248814a40ddf8475da7d1bfd845b90566ac39a3eaf
-
SSDEEP
12288:3rVZaJewWVF5X6I14syva1DP6vFgFBrdSCzUw8hUAGjsxH29/PrSCKpy7L9t8OSI:bVYJeWiy2DUqZKCAH8Hd7LX9S
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Localul_JampbNp.exeTrojan.exepid process 4304 Localul_JampbNp.exe 4744 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exeLocalul_JampbNp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Localul_JampbNp.exe -
Drops startup file 2 IoCs
Processes:
Trojan.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings 5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
Trojan.exepid process 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe 4744 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 4744 Trojan.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1372 OpenWith.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exeLocalul_JampbNp.exeTrojan.exedescription pid process target process PID 812 wrote to memory of 4304 812 5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exe Localul_JampbNp.exe PID 812 wrote to memory of 4304 812 5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exe Localul_JampbNp.exe PID 812 wrote to memory of 4304 812 5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exe Localul_JampbNp.exe PID 4304 wrote to memory of 4744 4304 Localul_JampbNp.exe Trojan.exe PID 4304 wrote to memory of 4744 4304 Localul_JampbNp.exe Trojan.exe PID 4304 wrote to memory of 4744 4304 Localul_JampbNp.exe Trojan.exe PID 4744 wrote to memory of 4032 4744 Trojan.exe netsh.exe PID 4744 wrote to memory of 4032 4744 Trojan.exe netsh.exe PID 4744 wrote to memory of 4032 4744 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exe"C:\Users\Admin\AppData\Local\Temp\5306a98d3e19f8f5b419e7eedc7a3a067984037144a68536943046c422021650.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Localul_JampbNp.exe"C:\Users\Admin\AppData\Localul_JampbNp.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
43KB
MD56b37a2be95704c0095c6f725ae2a7585
SHA13e88aa9095606aaf64fec687353c5659225e9950
SHA2563b341f1e12fcf5ef518a6720d986e3ece091cf7a336ae271ce082293a2da18ad
SHA5122de36f8c2b206213d09d4f7253e8ec9966d5faf7ace38538ec770f87e34e96a1399859ce455540e31352114906769df99843bb7615c498251abcc237257205b0
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
43KB
MD56b37a2be95704c0095c6f725ae2a7585
SHA13e88aa9095606aaf64fec687353c5659225e9950
SHA2563b341f1e12fcf5ef518a6720d986e3ece091cf7a336ae271ce082293a2da18ad
SHA5122de36f8c2b206213d09d4f7253e8ec9966d5faf7ace38538ec770f87e34e96a1399859ce455540e31352114906769df99843bb7615c498251abcc237257205b0
-
C:\Users\Admin\AppData\Localul_JampbNp.exeFilesize
43KB
MD56b37a2be95704c0095c6f725ae2a7585
SHA13e88aa9095606aaf64fec687353c5659225e9950
SHA2563b341f1e12fcf5ef518a6720d986e3ece091cf7a336ae271ce082293a2da18ad
SHA5122de36f8c2b206213d09d4f7253e8ec9966d5faf7ace38538ec770f87e34e96a1399859ce455540e31352114906769df99843bb7615c498251abcc237257205b0
-
C:\Users\Admin\AppData\Localul_JampbNp.exeFilesize
43KB
MD56b37a2be95704c0095c6f725ae2a7585
SHA13e88aa9095606aaf64fec687353c5659225e9950
SHA2563b341f1e12fcf5ef518a6720d986e3ece091cf7a336ae271ce082293a2da18ad
SHA5122de36f8c2b206213d09d4f7253e8ec9966d5faf7ace38538ec770f87e34e96a1399859ce455540e31352114906769df99843bb7615c498251abcc237257205b0
-
memory/812-132-0x00007FFD3B4A0000-0x00007FFD3BED6000-memory.dmpFilesize
10.2MB
-
memory/4032-142-0x0000000000000000-mapping.dmp
-
memory/4304-133-0x0000000000000000-mapping.dmp
-
memory/4304-136-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/4304-140-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/4744-137-0x0000000000000000-mapping.dmp
-
memory/4744-141-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/4744-143-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB