Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 02:40
Static task
static1
Behavioral task
behavioral1
Sample
da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe
Resource
win10v2004-20220812-en
General
-
Target
da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe
-
Size
64KB
-
MD5
69982a9ac1309dd9fadc5ce42fb03ef1
-
SHA1
5a64d376501b378b487374e72ed8fa9350c070e7
-
SHA256
da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5
-
SHA512
a90bd7cf6331a95ad64aabdb818a73b6d3f789cf91e22ab628ea148101fe3085aa595fd1d9d77dc82537c6f2e01823cd9e6a9ff1fd090b8495459edadf43b96c
-
SSDEEP
768:pNKsy2iE/LxDkXpX8+Q84vvuAegZrz3iZq0FNKPsBqEA1+3S654c8:7KsFD2ZX8+y+uaZq07KPsBq2x4c
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 968 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 968 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2116 da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2128 2116 da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe 80 PID 2116 wrote to memory of 2128 2116 da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe 80 PID 2116 wrote to memory of 2128 2116 da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe 80 PID 2128 wrote to memory of 968 2128 cmd.exe 82 PID 2128 wrote to memory of 968 2128 cmd.exe 82 PID 2128 wrote to memory of 968 2128 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe"C:\Users\Admin\AppData\Local\Temp\da57c46502578b8beb807cfa48bc1705c05ddb72aa8bbef4f9a164ef8a70cee5.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del da57c46502578b8beb807cfa48bc1705c02⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:968
-
-