Analysis
-
max time kernel
175s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 09:07
Static task
static1
Behavioral task
behavioral1
Sample
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe
Resource
win10v2004-20220812-en
General
-
Target
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe
-
Size
59KB
-
MD5
73b76081380127c9945b404a2e7cae90
-
SHA1
84ab59754437b503ff879f7508fe01ba2e546e9f
-
SHA256
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c
-
SHA512
43fa7892f314c565b7b2bfe92dc94ed0ca29b6d5ff0cf1e4830c78d5310078b9f11b96c6b3d6d734bcb8d7c241ce71e7d054a0a6a18faa92c7f4c22571d4cda6
-
SSDEEP
768:mJv3kWdVTiSz9Wls8iQh8BvbzinvHc2JscuqvqJPnmgl5Lk5xb4VjHpAh8bDXwVU:03R8H9Js5Lk5dO6V/MJEMCK/RXQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Trojan.exepid process 4268 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe -
Drops startup file 2 IoCs
Processes:
Trojan.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Trojan.exepid process 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe 4268 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 4268 Trojan.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exeTrojan.exedescription pid process target process PID 4456 wrote to memory of 4268 4456 c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe Trojan.exe PID 4456 wrote to memory of 4268 4456 c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe Trojan.exe PID 4456 wrote to memory of 4268 4456 c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe Trojan.exe PID 4268 wrote to memory of 1092 4268 Trojan.exe netsh.exe PID 4268 wrote to memory of 1092 4268 Trojan.exe netsh.exe PID 4268 wrote to memory of 1092 4268 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe"C:\Users\Admin\AppData\Local\Temp\c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
59KB
MD573b76081380127c9945b404a2e7cae90
SHA184ab59754437b503ff879f7508fe01ba2e546e9f
SHA256c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c
SHA51243fa7892f314c565b7b2bfe92dc94ed0ca29b6d5ff0cf1e4830c78d5310078b9f11b96c6b3d6d734bcb8d7c241ce71e7d054a0a6a18faa92c7f4c22571d4cda6
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
59KB
MD573b76081380127c9945b404a2e7cae90
SHA184ab59754437b503ff879f7508fe01ba2e546e9f
SHA256c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c
SHA51243fa7892f314c565b7b2bfe92dc94ed0ca29b6d5ff0cf1e4830c78d5310078b9f11b96c6b3d6d734bcb8d7c241ce71e7d054a0a6a18faa92c7f4c22571d4cda6
-
memory/1092-138-0x0000000000000000-mapping.dmp
-
memory/4268-135-0x0000000000000000-mapping.dmp
-
memory/4268-139-0x0000000005060000-0x00000000050F2000-memory.dmpFilesize
584KB
-
memory/4268-140-0x0000000005140000-0x000000000514A000-memory.dmpFilesize
40KB
-
memory/4456-132-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4456-133-0x0000000004A70000-0x0000000005014000-memory.dmpFilesize
5.6MB
-
memory/4456-134-0x0000000005020000-0x00000000050BC000-memory.dmpFilesize
624KB