Analysis

  • max time kernel
    101s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 08:37

General

  • Target

    c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe

  • Size

    85KB

  • MD5

    091bcddb5ceaa1f0c7e2d507c539c60f

  • SHA1

    e3cf67fe5611716ef26de6a18042500d9cfc4c39

  • SHA256

    c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb

  • SHA512

    61ccb06ae2a9cdec6ce919578edb6f598ba78c67b1a0426add56584676299009f3f33043f149608be5d8ff649edebbdae0d1f53045d26753f7c6af31a846a43a

  • SSDEEP

    1536:5JXLSNZSOyF/lewor4ZXkl3CkSRpliHyPm:5FutyjfVxIyLiS

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe
    "C:\Users\Admin\AppData\Local\Temp\c352d11f858c6d9cedf320cd5120db475c52c19b3d2e9352ba8c8b6bf4fde0fb.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 424927117 /t REG_SZ /d "%userprofile%\424927117.exe" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 424927117 /t REG_SZ /d "C:\Users\Admin\424927117.exe" /f
        3⤵
        • Adds Run key to start application
        PID:4400
    • C:\Windows\SysWOW64\shutdown.exe
      "C:\Windows\System32\shutdown.exe" /r /f /t 3
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3656
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C352D1~1.EXE > nul
      2⤵
        PID:2620
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa39f6855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2984

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/828-135-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/828-134-0x00000000004E0000-0x00000000004F9000-memory.dmp

      Filesize

      100KB