6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828

Analysis

max time kernel
107s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828.exe
Size

205KB
MD5

6decf6977ef34c42a8b901520065c091
SHA1

4682c4546f37e6bf9b860330d07d95e82997fac6
SHA256

6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828
SHA512

571b3c73d0f9e08ad15dfbba82ff9a6bd71d4f5137b52388c932cbcd7e2b7dd96aab5c7547e05572b5739419d923f41148521bbd9030ddb732b5670644db237e
SSDEEP

3072:2wjmK0lZmJ6mRngDnXGVOS4jdlbsq1ei3JxIwYEv58bfJv9FEyj+TF2ipxZ:2bNfagqOS4Dx1ei5xIwYY5WfJUTF7xZ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3280	FindDrive.exe
3320	30018260a85ef7b9ea783d2efc273c2a1d1eb.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.242.250.64

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3320	30018260a85ef7b9ea783d2efc273c2a1d1eb.exe
3320	30018260a85ef7b9ea783d2efc273c2a1d1eb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	30018260a85ef7b9ea783d2efc273c2a1d1eb.exe
Token: SeDebugPrivilege	3320	30018260a85ef7b9ea783d2efc273c2a1d1eb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3280	4508	6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828.exe	80
PID 4508 wrote to memory of 3280	4508	6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828.exe	80
PID 4508 wrote to memory of 3280	4508	6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828.exe	80
PID 4508 wrote to memory of 3320	4508	6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828.exe	82
PID 4508 wrote to memory of 3320	4508	6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828.exe	82
PID 4508 wrote to memory of 3320	4508	6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828.exe	82

C:\Users\Admin\AppData\Local\Temp\6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828.exe
"C:\Users\Admin\AppData\Local\Temp\6938d40afa76616dc2ad5f085e5ccce2f8298de8d12ec30ac58551b448115828.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\nsc75E2.tmp\FindDrive.exe
  "C:\Users\Admin\AppData\Local\Temp\nsc75E2.tmp\FindDrive.exe"
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Users\Admin\AppData\Local\Temp\nsc75E2.tmp\30018260a85ef7b9ea783d2efc273c2a1d1eb.exe
  "C:\Users\Admin\AppData\Local\Temp\nsc75E2.tmp\30018260a85ef7b9ea783d2efc273c2a1d1eb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsc75E2.tmp\30018260a85ef7b9ea783d2efc273c2a1d1eb.exe

Filesize
172KB

MD5
ac7f001df0c1b200690f4c500da6913e

SHA1
4a2bac0197453a53c8aa038f184acca1eb2b5a80

SHA256
9f4e734f320ae4e2a7271fd46571911cea03e18005b5d40dea462f2b82badf62

SHA512
8cb712ad29480add9ca2dd0392838b56a42e84950cde4bd21c621ac4147a38fb4b0829e9bc311444efe8d20e96ef5bd359542f299e784d94eeb7eab16225aad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc75E2.tmp\30018260a85ef7b9ea783d2efc273c2a1d1eb.exe

Filesize
172KB

MD5
ac7f001df0c1b200690f4c500da6913e

SHA1
4a2bac0197453a53c8aa038f184acca1eb2b5a80

SHA256
9f4e734f320ae4e2a7271fd46571911cea03e18005b5d40dea462f2b82badf62

SHA512
8cb712ad29480add9ca2dd0392838b56a42e84950cde4bd21c621ac4147a38fb4b0829e9bc311444efe8d20e96ef5bd359542f299e784d94eeb7eab16225aad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc75E2.tmp\FindDrive.exe

Filesize
60KB

MD5
a127e0fe0b9695eaeabf4d554c6ed74e

SHA1
6e38d43cbc13787dbe713ec80e36982d4d013332

SHA256
3406978944d28a313d0e80980bcfd9754f89b0b343fa3fff5ec4824646393ce9

SHA512
8d22f5f4a2cbd3ee54084f3f1209f2bea294559a3610b6adc725b0439a1bf81a1def0024209fee7ad7c6468838ee8e10d74db6011c808ea7480e1435477a5af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc75E2.tmp\FindDrive.exe

Filesize
60KB

MD5
a127e0fe0b9695eaeabf4d554c6ed74e

SHA1
6e38d43cbc13787dbe713ec80e36982d4d013332

SHA256
3406978944d28a313d0e80980bcfd9754f89b0b343fa3fff5ec4824646393ce9

SHA512
8d22f5f4a2cbd3ee54084f3f1209f2bea294559a3610b6adc725b0439a1bf81a1def0024209fee7ad7c6468838ee8e10d74db6011c808ea7480e1435477a5af7

Download Submit
memory/3320-138-0x0000000000560000-0x0000000000586000-memory.dmp

Filesize
152KB

Download
memory/3320-139-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3320-140-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download