Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2022 12:58
Static task
static1
Behavioral task
behavioral1
Sample
f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56.exe
Resource
win7-20220812-en
General
-
Target
f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56.exe
-
Size
191KB
-
MD5
699e7392535db8efd7a2e4e0ba279fec
-
SHA1
3d4d5a2ff6207f0dbbc842d3b8971bd512b1190f
-
SHA256
f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56
-
SHA512
a8eaeff4b5c348ede36f7e34d89774e41aa156e7cbcb835f717677332ae327890b0ab8823da277a94bbd89903df3578661ba8da65d4be99baac70f8826063aa7
-
SSDEEP
3072:ABittsFZbCwsqQcfizhLnQBrGxEGcG3TBf8EQjZqMNHDnvV85:ABikffsqQ7zdnQBrGuBG3TB4vj
Malware Config
Extracted
phorphiex
http://185.215.113.66/twizt/
12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc
1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD
3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg
3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz
qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8
DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG
0xb899fC445a1b61Cdd62266795193203aa72351fE
LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7
r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1
TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5
t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy
AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX
bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr
GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY
bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky
bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v
Signatures
-
Processes:
winuedrvs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winuedrvs.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
814A.exe1650930706.scrwinuedrvs.exe1246227471.exe1014415419.exepid process 2276 814A.exe 3604 1650930706.scr 2376 winuedrvs.exe 3828 1246227471.exe 3424 1014415419.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1246227471.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1246227471.exe -
Processes:
winuedrvs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" winuedrvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winuedrvs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1650930706.scrdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winuedrvs.exe" 1650930706.scr -
Drops file in Windows directory 2 IoCs
Processes:
1650930706.scrdescription ioc process File created C:\Windows\winuedrvs.exe 1650930706.scr File opened for modification C:\Windows\winuedrvs.exe 1650930706.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1246227471.exepid process 3828 1246227471.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1246227471.exedescription pid process Token: SeDebugPrivilege 3828 1246227471.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56.exe814A.exe1650930706.scrwinuedrvs.exe1246227471.execmd.execmd.exedescription pid process target process PID 3044 wrote to memory of 2276 3044 f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56.exe 814A.exe PID 3044 wrote to memory of 2276 3044 f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56.exe 814A.exe PID 3044 wrote to memory of 2276 3044 f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56.exe 814A.exe PID 2276 wrote to memory of 3604 2276 814A.exe 1650930706.scr PID 2276 wrote to memory of 3604 2276 814A.exe 1650930706.scr PID 2276 wrote to memory of 3604 2276 814A.exe 1650930706.scr PID 3604 wrote to memory of 2376 3604 1650930706.scr winuedrvs.exe PID 3604 wrote to memory of 2376 3604 1650930706.scr winuedrvs.exe PID 3604 wrote to memory of 2376 3604 1650930706.scr winuedrvs.exe PID 2376 wrote to memory of 3828 2376 winuedrvs.exe 1246227471.exe PID 2376 wrote to memory of 3828 2376 winuedrvs.exe 1246227471.exe PID 3828 wrote to memory of 4084 3828 1246227471.exe cmd.exe PID 3828 wrote to memory of 4084 3828 1246227471.exe cmd.exe PID 3828 wrote to memory of 4820 3828 1246227471.exe cmd.exe PID 3828 wrote to memory of 4820 3828 1246227471.exe cmd.exe PID 4084 wrote to memory of 1888 4084 cmd.exe reg.exe PID 4084 wrote to memory of 1888 4084 cmd.exe reg.exe PID 4820 wrote to memory of 2920 4820 cmd.exe schtasks.exe PID 4820 wrote to memory of 2920 4820 cmd.exe schtasks.exe PID 2376 wrote to memory of 3424 2376 winuedrvs.exe 1014415419.exe PID 2376 wrote to memory of 3424 2376 winuedrvs.exe 1014415419.exe PID 2376 wrote to memory of 3424 2376 winuedrvs.exe 1014415419.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56.exe"C:\Users\Admin\AppData\Local\Temp\f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\814A.exe"C:\Users\Admin\AppData\Local\Temp\814A.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1650930706.scrC:\Users\Admin\AppData\Local\Temp\1650930706.scr3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\winuedrvs.exeC:\Windows\winuedrvs.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1246227471.exeC:\Users\Admin\AppData\Local\Temp\1246227471.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "User Configuration" /f6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "User Configuration" /f7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "User Configuration"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "User Configuration"7⤵
-
C:\Users\Admin\AppData\Local\Temp\1014415419.exeC:\Users\Admin\AppData\Local\Temp\1014415419.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1014415419.exeFilesize
6KB
MD5f99a026691957a1490c606890021a4db
SHA14eca65b16ce9b8284f3fc54344f8ae15b406b4e1
SHA256db23276681cfb7d843bfc35b96e40dcb77b3bafcb87aa211d3fa6910da6937bd
SHA512e4d9f869e4c12667a91af5792213350b9205a6fd3a2175e3af39571f2066ffa6a4b398a010497f428310b91033b4d5555835ede6669793f5cfd79ae47321421f
-
C:\Users\Admin\AppData\Local\Temp\1014415419.exeFilesize
6KB
MD5f99a026691957a1490c606890021a4db
SHA14eca65b16ce9b8284f3fc54344f8ae15b406b4e1
SHA256db23276681cfb7d843bfc35b96e40dcb77b3bafcb87aa211d3fa6910da6937bd
SHA512e4d9f869e4c12667a91af5792213350b9205a6fd3a2175e3af39571f2066ffa6a4b398a010497f428310b91033b4d5555835ede6669793f5cfd79ae47321421f
-
C:\Users\Admin\AppData\Local\Temp\1246227471.exeFilesize
8KB
MD566bbb99fb92a3688d31a899992f73cdf
SHA1836fad08d9de8ea28c35d1885496af8e1284a6e7
SHA2561d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6
SHA5126a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36
-
C:\Users\Admin\AppData\Local\Temp\1246227471.exeFilesize
8KB
MD566bbb99fb92a3688d31a899992f73cdf
SHA1836fad08d9de8ea28c35d1885496af8e1284a6e7
SHA2561d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6
SHA5126a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36
-
C:\Users\Admin\AppData\Local\Temp\1650930706.scrFilesize
75KB
MD596de9c78028eaec7cd06d8e3e755ffc4
SHA1612d1261bce41723b0a981c92bf9f186c9d46fe2
SHA256d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
SHA5125906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f
-
C:\Users\Admin\AppData\Local\Temp\1650930706.scrFilesize
75KB
MD596de9c78028eaec7cd06d8e3e755ffc4
SHA1612d1261bce41723b0a981c92bf9f186c9d46fe2
SHA256d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
SHA5125906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f
-
C:\Users\Admin\AppData\Local\Temp\814A.exeFilesize
9KB
MD5fe304e909fb1f67c4d9030fc74d0a2f1
SHA11102fb973b3b83bbd5749db3ceb9405443c09dfe
SHA256a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96
SHA51246f797b30affdc7bc2291b2b1fb064246a7aa2359072380468abce1423b338859c0ad45b02c2dc5623d167ef51c65414e06890c7c9dfe4b9e305a0b70257f1aa
-
C:\Users\Admin\AppData\Local\Temp\814A.exeFilesize
9KB
MD5fe304e909fb1f67c4d9030fc74d0a2f1
SHA11102fb973b3b83bbd5749db3ceb9405443c09dfe
SHA256a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96
SHA51246f797b30affdc7bc2291b2b1fb064246a7aa2359072380468abce1423b338859c0ad45b02c2dc5623d167ef51c65414e06890c7c9dfe4b9e305a0b70257f1aa
-
C:\Windows\winuedrvs.exeFilesize
75KB
MD596de9c78028eaec7cd06d8e3e755ffc4
SHA1612d1261bce41723b0a981c92bf9f186c9d46fe2
SHA256d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
SHA5125906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f
-
C:\Windows\winuedrvs.exeFilesize
75KB
MD596de9c78028eaec7cd06d8e3e755ffc4
SHA1612d1261bce41723b0a981c92bf9f186c9d46fe2
SHA256d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
SHA5125906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f
-
memory/1888-147-0x0000000000000000-mapping.dmp
-
memory/2276-132-0x0000000000000000-mapping.dmp
-
memory/2376-138-0x0000000000000000-mapping.dmp
-
memory/2920-148-0x0000000000000000-mapping.dmp
-
memory/3424-151-0x0000000000000000-mapping.dmp
-
memory/3604-135-0x0000000000000000-mapping.dmp
-
memory/3828-150-0x00007FFBDB4D0000-0x00007FFBDBF91000-memory.dmpFilesize
10.8MB
-
memory/3828-149-0x00007FFBDB4D0000-0x00007FFBDBF91000-memory.dmpFilesize
10.8MB
-
memory/3828-144-0x00000000008E0000-0x00000000008E6000-memory.dmpFilesize
24KB
-
memory/3828-141-0x0000000000000000-mapping.dmp
-
memory/4084-145-0x0000000000000000-mapping.dmp
-
memory/4820-146-0x0000000000000000-mapping.dmp