Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 07:00
Static task
static1
Behavioral task
behavioral1
Sample
TDD500000000000000000000000000000000000000.exe
Resource
win7-20220812-en
General
-
Target
TDD500000000000000000000000000000000000000.exe
-
Size
713KB
-
MD5
813890550ca56d37b0a986bf8cdde0b1
-
SHA1
88c1c4caca723a71c3f308fc8d66a44eb4a0230f
-
SHA256
3b56d7fd728103d3269e18e272e22d521d7c6c2304a2665217b1000631dded9d
-
SHA512
b29a49c5a17c2e91eeeb07816f39b0445a638452dde9841762c6a6130ee357320183f3cd68a299dc31f534d6c5dcf8839218fdbf49aca8a51d49bc4a247043e7
-
SSDEEP
12288:8ToPWBv/cpGrU3yH7mtstmTHIoELSbcV1W4WdV0zJPx:8TbBv5rUsmymTo7LSYxPx
Malware Config
Extracted
formbook
qqci
QetTqZClp7wFVN7CUjvCiA==
3ZTYDLbtEiw+OynhJ9HGmQ==
ZyJunbSaaekF
OOwyczoCsSvKuI0H
S/FAZYtKY2vVzCc5qIiU
axVWijjhaCVDmZpGTt3RUxGrgZIZjcapEw==
1oHQ73CAnJntuX8=
Huo0LA3V+0JZHgONI/JPQ8UJ
BKzl63IkrnSA5W41XFM=
yoHbAS7smafIszYSGkQ=
iTyFttfzdTBbmGkOV67Mjg==
KcwIME5r+IeTEv+4PVTMOV2tqTzT3w==
FLXq6sZddO4Fm4VR95ScwqT66yI=
u2SjgGoNCB0lHuGBpskelaT66yI=
0YrQwnYjYNF2v3sQ
l0O9vrjpiyM91b54/JPPguMe
P+BLw9L68iIY
AZQeZo+7cXLIRN2gtg==
K94UQ2snUJC3gl45qIiU
vlewBydLxlB05sOKHzbPguMe
wYLuH5hQAwIbHM98onCzs29Agw==
5Hq72YtB6ajKRN2gtg==
pDx/w1UENO8fiA==
fIWzS5v++bQLVd7CUjvCiA==
pFih7EPyEWeBNC3bXDvCiA==
C70OREb3+jVaq4Ya
7p7eI9z9+tbqNwzITGy2s29Agw==
9Z/sErp2LzHKuI0H
hTh5xRLT80CQmjYSGkQ=
43/ZF+Jz/M7dPzDvlm2FrFDmGB3GwA==
ymylAjz+IjpUVU0B9pP4dknYxDsoBQk=
qUSBqT1bZnCHhVQQV67Mjg==
m0CHu1lvZTlYlTYSGkQ=
AKruCrpK3K72kUw/djyR
NtIwo/qx3mO49eCbLkmc
x27C4WuRuQUh8sRaCKM8sIM=
7ZPi1iboixp2v3sQ
JdoHJZ8aAw1gnQ==
ymrKFDRQ7+H/RN2gtg==
VuFAcAgwMz1hWyG1YgZPQ8UJ
RtAviy1ej5ntuX8=
It8uRdP/InDIEqNET10=
hDd3swzH7mqLDNlhbBIZlKT66yI=
x26qw0t+ren/1rNM4YjPguMe
8HvAxWwYy9U0+uu0sw==
kUej2FoNw8zg/dZwncgYkaT66yI=
D8g1eZvHRIvvcVwY
K9EhCeiGi5ntuX8=
xXKo874S7O7+RN2gtg==
n02i44k3qwZNak8OV67Mjg==
K7D5NP7JZPZBFOesvaM8sIM=
/aTvH8Hd3en/RN2gtg==
vVnA7Wwqy5/398V+9o3o4SEYmNcCzg==
SuIwiiA6UZfr8r5U+IvLksrjaxNO
mTRvYcBwFfFG5W41XFM=
r0ioHNyiSA4tpCW1vA==
L9JMewEdHCx2wbRufxwl4Pa2vjsoBQk=
+6zwQJ9BNk5oXTD+A5eys29Agw==
cQdbRaA5y8vw78FbDKM8sIM=
izZsoFcBi1LfKR/UB67As29Agw==
uG6w4gQftoLWVzLqfVr2IObscw1O
ArcJMU6FLPERXjc5qIiU
C6ry8EcUt+U=
FLvvQnctVp64nk5DUF0=
dn8bmxv4vfcl67x.xyz
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
frqcewggrhw.exepid process 2320 frqcewggrhw.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
TDD500000000000000000000000000000000000000.exefrqcewggrhw.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation TDD500000000000000000000000000000000000000.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation frqcewggrhw.exe -
Loads dropped DLL 1 IoCs
Processes:
frqcewggrhw.exepid process 1428 frqcewggrhw.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
frqcewggrhw.exefrqcewggrhw.exeWWAHost.exedescription pid process target process PID 2320 set thread context of 1428 2320 frqcewggrhw.exe frqcewggrhw.exe PID 1428 set thread context of 2180 1428 frqcewggrhw.exe Explorer.EXE PID 4092 set thread context of 2180 4092 WWAHost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 344 2320 WerFault.exe frqcewggrhw.exe -
Processes:
WWAHost.exedescription ioc process Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 WWAHost.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
frqcewggrhw.exeWWAHost.exepid process 1428 frqcewggrhw.exe 1428 frqcewggrhw.exe 1428 frqcewggrhw.exe 1428 frqcewggrhw.exe 1428 frqcewggrhw.exe 1428 frqcewggrhw.exe 1428 frqcewggrhw.exe 1428 frqcewggrhw.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2180 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
frqcewggrhw.exeWWAHost.exepid process 1428 frqcewggrhw.exe 1428 frqcewggrhw.exe 1428 frqcewggrhw.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe 4092 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
frqcewggrhw.exeWWAHost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1428 frqcewggrhw.exe Token: SeDebugPrivilege 4092 WWAHost.exe Token: SeShutdownPrivilege 2180 Explorer.EXE Token: SeCreatePagefilePrivilege 2180 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
TDD500000000000000000000000000000000000000.exefrqcewggrhw.exeExplorer.EXEWWAHost.exedescription pid process target process PID 3988 wrote to memory of 2320 3988 TDD500000000000000000000000000000000000000.exe frqcewggrhw.exe PID 3988 wrote to memory of 2320 3988 TDD500000000000000000000000000000000000000.exe frqcewggrhw.exe PID 3988 wrote to memory of 2320 3988 TDD500000000000000000000000000000000000000.exe frqcewggrhw.exe PID 2320 wrote to memory of 1428 2320 frqcewggrhw.exe frqcewggrhw.exe PID 2320 wrote to memory of 1428 2320 frqcewggrhw.exe frqcewggrhw.exe PID 2320 wrote to memory of 1428 2320 frqcewggrhw.exe frqcewggrhw.exe PID 2320 wrote to memory of 1428 2320 frqcewggrhw.exe frqcewggrhw.exe PID 2180 wrote to memory of 4092 2180 Explorer.EXE WWAHost.exe PID 2180 wrote to memory of 4092 2180 Explorer.EXE WWAHost.exe PID 2180 wrote to memory of 4092 2180 Explorer.EXE WWAHost.exe PID 4092 wrote to memory of 4808 4092 WWAHost.exe Firefox.exe PID 4092 wrote to memory of 4808 4092 WWAHost.exe Firefox.exe PID 4092 wrote to memory of 4808 4092 WWAHost.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TDD500000000000000000000000000000000000000.exe"C:\Users\Admin\AppData\Local\Temp\TDD500000000000000000000000000000000000000.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exe"C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exe"C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exe"4⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 5284⤵
- Program crash
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2320 -ip 23201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
C:\Users\Admin\AppData\Local\Temp\frqcewggrhw.exeFilesize
56KB
MD5d0e90c275950aa6655921911057a9b8e
SHA156f2a2c421510e2772edee874e146196a5409597
SHA256ff1bc96bcef0db6b933fefa041e8e38fbec9192d4ea53b309e5ba95ffb8b1ec8
SHA512486fcfc96b28e20b6532fdf5ef6a986f25a3729b2c5331fd09291f999f841e820a52302ff3ff612873414aa683176b942eadac5c35605f70d7f7d9ed736df549
-
C:\Users\Admin\AppData\Local\Temp\qnzrnm.mwxFilesize
4KB
MD554c2259abdb49f848bdba460ed858024
SHA17e655cb9bda0b43fc00e60615a3a87582f2c55f8
SHA2562998820c59e87763d0106ff04418db0ddd5623590dd97f5e9de4ad42bc7c6148
SHA5126a317219345a48639912dfa4d080f22e2d070f7c3d2f286dc38414b91ede67ca421d8fa29e65f7fbd019ba2ce0dd92cca4fa6bd4346f6d15909b5e8e0b1cf9f8
-
C:\Users\Admin\AppData\Local\Temp\wxqklo.lgyFilesize
185KB
MD55a21846043f65aeaab1a75e456fea017
SHA129af7fc55f4e3e3a98f4f298c062dab4f4c3ad47
SHA256af680a037c85b1bff053ad6a4d5b4bf919fcd55230f0cd719a2a473c4ffe2f92
SHA512d7dbb860b99dc34a2156934277fce9507cae2b59da2e2eb06d61c60001610dfebc189e2ce4e9fe491b05e4f0ce9225142b8849a26b0a12b27c612c230bb97738
-
memory/1428-142-0x0000000000C50000-0x0000000000C60000-memory.dmpFilesize
64KB
-
memory/1428-139-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1428-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1428-141-0x0000000001210000-0x000000000155A000-memory.dmpFilesize
3.3MB
-
memory/1428-137-0x0000000000000000-mapping.dmp
-
memory/1428-145-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2180-150-0x0000000008380000-0x00000000084E0000-memory.dmpFilesize
1.4MB
-
memory/2180-143-0x0000000003610000-0x0000000003766000-memory.dmpFilesize
1.3MB
-
memory/2180-152-0x0000000008380000-0x00000000084E0000-memory.dmpFilesize
1.4MB
-
memory/2320-132-0x0000000000000000-mapping.dmp
-
memory/4092-144-0x0000000000000000-mapping.dmp
-
memory/4092-148-0x0000000001360000-0x00000000016AA000-memory.dmpFilesize
3.3MB
-
memory/4092-147-0x00000000006B0000-0x00000000006DD000-memory.dmpFilesize
180KB
-
memory/4092-149-0x00000000010A0000-0x000000000112F000-memory.dmpFilesize
572KB
-
memory/4092-151-0x00000000006B0000-0x00000000006DD000-memory.dmpFilesize
180KB
-
memory/4092-146-0x0000000000720000-0x00000000007FC000-memory.dmpFilesize
880KB