4ff17757e7b6d0d9abea660efaf9efeb28ee85f5d2841fe27321588dc74a7e69

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 203KB
Sample221004-vvtvmsbhfp
SHA256 4ff17757e7b6d0d9abea660efaf9efeb28ee85f5d2841fe27321588dc74a7e69
MD5 f73d211e5b99426bdaa32d50369dd54a
SHA1 1b56fca828f1e472e5395c28c775386b31e7719e
SHA512 ac4a4bd5488c9a6d445be9691c18a678700bb15250bf6493680be310e020467bf66e991cae184b0845d2fb413026ee63c5edd035efa03f03c81b058c52addab3
SSDEEP 1536:WI47GyTGCwiSnmQUt0LB1sRs5gj5U/uLne:WvGyYiSDnt1s+5Gc
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4064	SETUP_~1.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	SETUP_~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{DE4CD3DD-FF83-4FBC-AC25-31D02700A244}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{2CABF8AD-A079-46E4-88E9-7736F08D0B10}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
920	powershell.exe
920	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	SETUP_~1.EXE
Token: SeDebugPrivilege	920	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4064	1828	file.exe	77
PID 1828 wrote to memory of 4064	1828	file.exe	77
PID 1828 wrote to memory of 4064	1828	file.exe	77
PID 4064 wrote to memory of 920	4064	SETUP_~1.EXE	94
PID 4064 wrote to memory of 920	4064	SETUP_~1.EXE	94
PID 4064 wrote to memory of 920	4064	SETUP_~1.EXE	94

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.4MB
SHA256 c46ac8c008b28266d134a9e7eb2cf1df80b20a072354336bd59190038a26fa1a
MD5 2b987f92c4645d1590d77cdd580a83d0
SHA1 b735870ae488cb652fd9f7f90394f757ae46184c
SHA512 6059fc2425f3e2ea4e0698011aee6c56c24b8ed2583d581577add435118037c3dcfb12e3f9036c1600f5754461a552545336ef2e3bb906504cc82cfaf4e3e5e5
SSDEEP 192:qCXF79ZCO9Y3A42Le/tFKkgKG0aOo5peTh:qOZCv3N2Le/tFBdGHeT
MD5 SHA1 SHA512 SSDEEP

Submit Download

SETUP_~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Size 95.4MB
SHA256 c46ac8c008b28266d134a9e7eb2cf1df80b20a072354336bd59190038a26fa1a
MD5 2b987f92c4645d1590d77cdd580a83d0
SHA1 b735870ae488cb652fd9f7f90394f757ae46184c
SHA512 6059fc2425f3e2ea4e0698011aee6c56c24b8ed2583d581577add435118037c3dcfb12e3f9036c1600f5754461a552545336ef2e3bb906504cc82cfaf4e3e5e5
SSDEEP 192:qCXF79ZCO9Y3A42Le/tFKkgKG0aOo5peTh:qOZCv3N2Le/tFBdGHeT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/920-141-0x0000000005660000-0x00000000056C6000-memory.dmp

Download

memory/920-138-0x0000000002340000-0x0000000002376000-memory.dmp

Download

memory/920-139-0x0000000004F30000-0x0000000005558000-memory.dmp

Download

memory/920-140-0x0000000004E90000-0x0000000004EF6000-memory.dmp

Download

memory/920-142-0x0000000004F00000-0x0000000004F1E000-memory.dmp

Download

memory/920-143-0x00000000072F0000-0x000000000796A000-memory.dmp

Download

memory/920-144-0x0000000006180000-0x000000000619A000-memory.dmp

Download

memory/4064-135-0x0000000000740000-0x0000000000748000-memory.dmp

Download

memory/4064-136-0x0000000005470000-0x0000000005492000-memory.dmp

Download