9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607

General

Target

9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607.exe
Size

336KB
MD5

628ec815037575517717a42056b30790
SHA1

cd2c8eb44deda4088d0c377dc8bbce5d2940db6c
SHA256

9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607
SHA512

3f0c5c1345ac63d1bca30dbe34629bddc617f59234190da9208e88f745bdceb11b4ac1113ac063adfe7624d7a52d4735a0f2e3ed25a06429d75a22459da11f95
SSDEEP

1536:ja2UssW/RGl5657uYQRedx+g/8+LNKI4pTk8JnWwTYR2Y+ycQTc4KZ06tPgK/sa5:j+lW+GOskh+lIL35FgVrhi9mOr

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4840	835.exe
2356	271.exe
3596	wnetwatcher.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1844	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	271.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\898dc05219f75f5eecc8fafc0d47e0c4.exe	wnetwatcher.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\898dc05219f75f5eecc8fafc0d47e0c4.exe	wnetwatcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\898dc05219f75f5eecc8fafc0d47e0c4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wnetwatcher.exe\" .."	wnetwatcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\898dc05219f75f5eecc8fafc0d47e0c4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wnetwatcher.exe\" .."	wnetwatcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe
3596	wnetwatcher.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	wnetwatcher.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 4840	3716	9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607.exe	82
PID 3716 wrote to memory of 4840	3716	9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607.exe	82
PID 4840 wrote to memory of 2356	4840	835.exe	83
PID 4840 wrote to memory of 2356	4840	835.exe	83
PID 4840 wrote to memory of 2356	4840	835.exe	83
PID 2356 wrote to memory of 3596	2356	271.exe	84
PID 2356 wrote to memory of 3596	2356	271.exe	84
PID 2356 wrote to memory of 3596	2356	271.exe	84
PID 3596 wrote to memory of 1844	3596	wnetwatcher.exe	85
PID 3596 wrote to memory of 1844	3596	wnetwatcher.exe	85
PID 3596 wrote to memory of 1844	3596	wnetwatcher.exe	85

C:\Users\Admin\AppData\Local\Temp\9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607.exe
"C:\Users\Admin\AppData\Local\Temp\9830f63ebad1f1317456e9eaa7df86bf4da592da962c9e20d27968b6cfd85607.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Local\Temp\835.exe
  C:\Users\Admin\AppData\Local\Temp\835.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Users\Admin\AppData\Local\Temp\271.exe
    C:\Users\Admin\AppData\Local\Temp\271.exe
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\wnetwatcher.exe
      "C:\Users\Admin\AppData\Local\Temp\wnetwatcher.exe"
      4⤵
      Executes dropped EXE
      Drops startup file
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3596
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\wnetwatcher.exe" "wnetwatcher.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:1844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\271.exe

Filesize
43KB

MD5
7003c15102cfaba7e95c6bd3f24cc6b4

SHA1
44a261ac65196e588392f116968ec7e7fd4988ed

SHA256
c739b2cbbefa3a8715cd3ec84374dbb03b334dbfe3698db4023a33fc2b8f6fd5

SHA512
8f8321de8f97c6af710f3e443fc8083f14b921490f2d38cb3fd267a0ebf8eeaaaa4aa36976d54e55f8e2f60b40b9188b31252cf360dfdbcbadf85c17cad5a089

Download Submit
C:\Users\Admin\AppData\Local\Temp\271.exe

Filesize
43KB

MD5
7003c15102cfaba7e95c6bd3f24cc6b4

SHA1
44a261ac65196e588392f116968ec7e7fd4988ed

SHA256
c739b2cbbefa3a8715cd3ec84374dbb03b334dbfe3698db4023a33fc2b8f6fd5

SHA512
8f8321de8f97c6af710f3e443fc8083f14b921490f2d38cb3fd267a0ebf8eeaaaa4aa36976d54e55f8e2f60b40b9188b31252cf360dfdbcbadf85c17cad5a089

Download Submit
C:\Users\Admin\AppData\Local\Temp\835.exe

Filesize
123KB

MD5
2d7b4ce5919ea6bfe7de874b94f02ce0

SHA1
db0211cb99a168f93eacda5eacdcaa63908941a0

SHA256
d31560e74fb91eab70da99c7566045184e30d5965bd3ecf993564ca93a72fa3a

SHA512
51b2720b4b047fbe5727bfce5183dfd33474fc86ae20bd6e785ff15791cdf0009a4297d2bb55b823820dc9bbccb5d17560b1dd4461d2f38c03ae2bcba0c0fa05

Download Submit
C:\Users\Admin\AppData\Local\Temp\835.exe

Filesize
123KB

MD5
2d7b4ce5919ea6bfe7de874b94f02ce0

SHA1
db0211cb99a168f93eacda5eacdcaa63908941a0

SHA256
d31560e74fb91eab70da99c7566045184e30d5965bd3ecf993564ca93a72fa3a

SHA512
51b2720b4b047fbe5727bfce5183dfd33474fc86ae20bd6e785ff15791cdf0009a4297d2bb55b823820dc9bbccb5d17560b1dd4461d2f38c03ae2bcba0c0fa05

Download Submit
C:\Users\Admin\AppData\Local\Temp\wnetwatcher.exe

Filesize
43KB

MD5
7003c15102cfaba7e95c6bd3f24cc6b4

SHA1
44a261ac65196e588392f116968ec7e7fd4988ed

SHA256
c739b2cbbefa3a8715cd3ec84374dbb03b334dbfe3698db4023a33fc2b8f6fd5

SHA512
8f8321de8f97c6af710f3e443fc8083f14b921490f2d38cb3fd267a0ebf8eeaaaa4aa36976d54e55f8e2f60b40b9188b31252cf360dfdbcbadf85c17cad5a089

Download Submit
C:\Users\Admin\AppData\Local\Temp\wnetwatcher.exe

Filesize
43KB

MD5
7003c15102cfaba7e95c6bd3f24cc6b4

SHA1
44a261ac65196e588392f116968ec7e7fd4988ed

SHA256
c739b2cbbefa3a8715cd3ec84374dbb03b334dbfe3698db4023a33fc2b8f6fd5

SHA512
8f8321de8f97c6af710f3e443fc8083f14b921490f2d38cb3fd267a0ebf8eeaaaa4aa36976d54e55f8e2f60b40b9188b31252cf360dfdbcbadf85c17cad5a089

Download Submit
memory/2356-142-0x0000000074F20000-0x00000000754D1000-memory.dmp

Filesize
5.7MB

Download
memory/2356-148-0x0000000074F20000-0x00000000754D1000-memory.dmp

Filesize
5.7MB

Download
memory/3596-149-0x0000000074F20000-0x00000000754D1000-memory.dmp

Filesize
5.7MB

Download
memory/3596-151-0x0000000074F20000-0x00000000754D1000-memory.dmp

Filesize
5.7MB

Download
memory/3716-132-0x00000000004D0000-0x000000000052A000-memory.dmp

Filesize
360KB

Download
memory/3716-137-0x00007FF80C090000-0x00007FF80CB51000-memory.dmp

Filesize
10.8MB

Download
memory/3716-150-0x00007FF80C090000-0x00007FF80CB51000-memory.dmp

Filesize
10.8MB

Download
memory/4840-138-0x00007FF80C090000-0x00007FF80CB51000-memory.dmp

Filesize
10.8MB

Download
memory/4840-143-0x00007FF80C090000-0x00007FF80CB51000-memory.dmp

Filesize
10.8MB

Download
memory/4840-136-0x0000000000600000-0x0000000000626000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing