5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO 059420.exe
Size 527KB
Sample221003-qtpgbahdfp
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3056	Host.exe
5044	Host.exe
4932	Host.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Host.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	PO 059420.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	PO 059420.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 1184	2252	PO 059420.exe	96
PID 3056 set thread context of 4932	3056	Host.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4316	schtasks.exe
3624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2252	PO 059420.exe
2252	PO 059420.exe
2252	PO 059420.exe
2252	PO 059420.exe
2252	PO 059420.exe
2252	PO 059420.exe
2252	PO 059420.exe
2252	PO 059420.exe
2252	PO 059420.exe
3056	Host.exe
3056	Host.exe
3056	Host.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	PO 059420.exe
Token: SeDebugPrivilege	3056	Host.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4316	2252	PO 059420.exe	90
PID 2252 wrote to memory of 4316	2252	PO 059420.exe	90
PID 2252 wrote to memory of 4316	2252	PO 059420.exe	90
PID 2252 wrote to memory of 2804	2252	PO 059420.exe	92
PID 2252 wrote to memory of 2804	2252	PO 059420.exe	92
PID 2252 wrote to memory of 2804	2252	PO 059420.exe	92
PID 2252 wrote to memory of 3452	2252	PO 059420.exe	93
PID 2252 wrote to memory of 3452	2252	PO 059420.exe	93
PID 2252 wrote to memory of 3452	2252	PO 059420.exe	93
PID 2252 wrote to memory of 1308	2252	PO 059420.exe	94
PID 2252 wrote to memory of 1308	2252	PO 059420.exe	94
PID 2252 wrote to memory of 1308	2252	PO 059420.exe	94
PID 2252 wrote to memory of 4056	2252	PO 059420.exe	95
PID 2252 wrote to memory of 4056	2252	PO 059420.exe	95
PID 2252 wrote to memory of 4056	2252	PO 059420.exe	95
PID 2252 wrote to memory of 1184	2252	PO 059420.exe	96
PID 2252 wrote to memory of 1184	2252	PO 059420.exe	96
PID 2252 wrote to memory of 1184	2252	PO 059420.exe	96
PID 2252 wrote to memory of 1184	2252	PO 059420.exe	96
PID 2252 wrote to memory of 1184	2252	PO 059420.exe	96
PID 2252 wrote to memory of 1184	2252	PO 059420.exe	96
PID 2252 wrote to memory of 1184	2252	PO 059420.exe	96
PID 2252 wrote to memory of 1184	2252	PO 059420.exe	96
PID 2252 wrote to memory of 1184	2252	PO 059420.exe	96
PID 2252 wrote to memory of 1184	2252	PO 059420.exe	96
PID 1184 wrote to memory of 3056	1184	PO 059420.exe	97
PID 1184 wrote to memory of 3056	1184	PO 059420.exe	97
PID 1184 wrote to memory of 3056	1184	PO 059420.exe	97
PID 3056 wrote to memory of 3624	3056	Host.exe	98
PID 3056 wrote to memory of 3624	3056	Host.exe	98
PID 3056 wrote to memory of 3624	3056	Host.exe	98
PID 3056 wrote to memory of 5044	3056	Host.exe	100
PID 3056 wrote to memory of 5044	3056	Host.exe	100
PID 3056 wrote to memory of 5044	3056	Host.exe	100
PID 3056 wrote to memory of 4932	3056	Host.exe	101
PID 3056 wrote to memory of 4932	3056	Host.exe	101
PID 3056 wrote to memory of 4932	3056	Host.exe	101
PID 3056 wrote to memory of 4932	3056	Host.exe	101
PID 3056 wrote to memory of 4932	3056	Host.exe	101
PID 3056 wrote to memory of 4932	3056	Host.exe	101
PID 3056 wrote to memory of 4932	3056	Host.exe	101
PID 3056 wrote to memory of 4932	3056	Host.exe	101
PID 3056 wrote to memory of 4932	3056	Host.exe	101
PID 3056 wrote to memory of 4932	3056	Host.exe	101

C:\Users\Admin\AppData\Local\Temp\PO 059420.exe
"C:\Users\Admin\AppData\Local\Temp\PO 059420.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgzBzcEDZDX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F97.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4316
- C:\Users\Admin\AppData\Local\Temp\PO 059420.exe
  "{path}"
  2⤵
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\PO 059420.exe
  "{path}"
  2⤵
  PID:3452
- C:\Users\Admin\AppData\Local\Temp\PO 059420.exe
  "{path}"
  2⤵
  PID:1308
- C:\Users\Admin\AppData\Local\Temp\PO 059420.exe
  "{path}"
  2⤵
  PID:4056
- C:\Users\Admin\AppData\Local\Temp\PO 059420.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Users\Admin\AppData\Roaming\Install\Host.exe
    "C:\Users\Admin\AppData\Roaming\Install\Host.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pgzBzcEDZDX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBBDE.tmp"
      4⤵
      Creates scheduled task(s)
      PID:3624
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:5044
  - - C:\Users\Admin\AppData\Roaming\Install\Host.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:4932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4F97.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4F97.tmp
Size 1KB
SHA256 4079184a801c8b4c9b0ed8a9b3de906ef0fc0ebf10de2b49e57ea6699c6db9f6
MD5 e08c4d4931fc64ff3ab036fb606f2b62
SHA1 f48a68a2c7858632acf2524d08b04aa339f1c660
SHA512 74657f17e6428b6cf225d4423f15b02ed32c873b8390551c2f3756dd918c6d7a18e4d26ca58be422a80451b9d72d3f0e4085220511919048d52d95e88c09c248
MD5 SHA1 SHA512

Submit Download

tmpBBDE.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpBBDE.tmp
Size 1KB
SHA256 4079184a801c8b4c9b0ed8a9b3de906ef0fc0ebf10de2b49e57ea6699c6db9f6
MD5 e08c4d4931fc64ff3ab036fb606f2b62
SHA1 f48a68a2c7858632acf2524d08b04aa339f1c660
SHA512 74657f17e6428b6cf225d4423f15b02ed32c873b8390551c2f3756dd918c6d7a18e4d26ca58be422a80451b9d72d3f0e4085220511919048d52d95e88c09c248
MD5 SHA1 SHA512

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 527KB
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 527KB
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 527KB
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Host.exe

Path C:\Users\Admin\AppData\Roaming\Install\Host.exe
Size 527KB
SHA256 5f2a513bb02d1432e658ac0d65327d0ed56f6a4f1e014de8e4ff50fcf738ca93
MD5 139deb18239c1db30775b256717b91a6
SHA1 3539a4b24d8f5b601d99a2239f5f18e17cd5fb04
SHA512 7e27e7d7ea24795ec51c2eea762f4dcb4dbad04ace4965b78b16609152e3c346ffa4d6b231a9ded9f4dd2eca7493e54b5d1cab82e0a6a4c56a3a07b44f64bbf7
SSDEEP 12288:wucnf2iNF7xankO5z2Z3hTH5IPudSGATPjeDc4pDp4ClYdRU:wRf1f79Oh2Z35H2GdMPjucopjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1184-144-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1184-145-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1184-146-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1184-149-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2252-132-0x00000000001D0000-0x0000000000258000-memory.dmp

Download

memory/2252-136-0x0000000004CA0000-0x0000000004CAA000-memory.dmp

Download

memory/2252-135-0x0000000004D40000-0x0000000004DDC000-memory.dmp

Download

memory/2252-134-0x0000000004C00000-0x0000000004C92000-memory.dmp

Download

memory/2252-133-0x00000000051B0000-0x0000000005754000-memory.dmp

Download

memory/4932-159-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4932-158-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4932-160-0x0000000000400000-0x000000000042B000-memory.dmp

Download