Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 01:52
Static task
static1
Behavioral task
behavioral1
Sample
906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe
-
Size
132KB
-
MD5
6eecc3f6e2dc89420281d8a767658e20
-
SHA1
cfe8eadc1bb8878ae56ea4db90afb4fbbeea4522
-
SHA256
906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b
-
SHA512
d07458ad9f357b48d5788f965e5882ff718314bbd9acba9a47e0dbc85b32759a2b029a25f0a44ec57517f71749bcbe1b9c2867b6e08449e226d0f9e1534d77eb
-
SSDEEP
1536:bHFjwOqUuflO+6peVdM/d2yv6n0APB8qFE0OSqHW2PYoPPrCLaC46lxIDCwMZOD7:ryOqxY+6pejzNB8A4xAo784KmMMDLH
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2816 indiagamcaa.exe 4400 indiagamcaa.exe -
resource yara_rule behavioral2/memory/1900-135-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1900-137-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1900-138-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1900-141-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1900-159-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4400-160-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4400-161-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\indiagamcaaa = "C:\\Users\\Admin\\AppData\\Roaming\\india gamcaa\\indiagamcaa.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3268 set thread context of 1900 3268 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 87 PID 2816 set thread context of 4400 2816 indiagamcaa.exe 96 PID 2816 set thread context of 0 2816 indiagamcaa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe Token: SeDebugPrivilege 4400 indiagamcaa.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3268 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 1900 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 2816 indiagamcaa.exe 4400 indiagamcaa.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 3268 wrote to memory of 1900 3268 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 87 PID 3268 wrote to memory of 1900 3268 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 87 PID 3268 wrote to memory of 1900 3268 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 87 PID 3268 wrote to memory of 1900 3268 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 87 PID 3268 wrote to memory of 1900 3268 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 87 PID 3268 wrote to memory of 1900 3268 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 87 PID 3268 wrote to memory of 1900 3268 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 87 PID 3268 wrote to memory of 1900 3268 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 87 PID 1900 wrote to memory of 4424 1900 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 89 PID 1900 wrote to memory of 4424 1900 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 89 PID 1900 wrote to memory of 4424 1900 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 89 PID 4424 wrote to memory of 1116 4424 cmd.exe 92 PID 4424 wrote to memory of 1116 4424 cmd.exe 92 PID 4424 wrote to memory of 1116 4424 cmd.exe 92 PID 1900 wrote to memory of 2816 1900 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 93 PID 1900 wrote to memory of 2816 1900 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 93 PID 1900 wrote to memory of 2816 1900 906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe 93 PID 2816 wrote to memory of 4400 2816 indiagamcaa.exe 96 PID 2816 wrote to memory of 4400 2816 indiagamcaa.exe 96 PID 2816 wrote to memory of 4400 2816 indiagamcaa.exe 96 PID 2816 wrote to memory of 4400 2816 indiagamcaa.exe 96 PID 2816 wrote to memory of 4400 2816 indiagamcaa.exe 96 PID 2816 wrote to memory of 4400 2816 indiagamcaa.exe 96 PID 2816 wrote to memory of 4400 2816 indiagamcaa.exe 96 PID 2816 wrote to memory of 4400 2816 indiagamcaa.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe"C:\Users\Admin\AppData\Local\Temp\906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe"C:\Users\Admin\AppData\Local\Temp\906ff4faa3bd749a4f1015f7fd9b476d77c1f4277613a341cec047a55f1a402b.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ROSOV.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "indiagamcaaa" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe" /f4⤵
- Adds Run key to start application
PID:1116
-
-
-
C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"C:\Users\Admin\AppData\Roaming\india gamcaa\indiagamcaa.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4400
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
158B
MD5033ff48e13742ca54269e0846484b830
SHA1082ce1eed215dda59ea75a8227f8cd0e1b15d36f
SHA256597efbff7588882d8866604df4e7a4f715418a7d9bae4736029412fda3bfa455
SHA5128727692731b3788a5f8a5b5d4e79f009a8953d9a236f66e4cdc963c82c9aff3b6e833a491f78f88d55d8bad4d46f5d81e279974600ddbe5ea2c42003f043adda
-
Filesize
132KB
MD5b98921807208b62b83b57adbd7a0bf8a
SHA1cc641b5bb417e22a29c4303fdbe277cfd7cfbbc6
SHA2561f699113a3ad51fd842c8ecfc4b225ed5a564e6c8f4a5c96092433e58d9390fa
SHA512b02d243810e9fc1f8e1dad831be8066c35be061c5dd7dc7676c31fe3d851b3fc292837bae318fc3b8b758f0deda84a072892058153bf96a5ada062f860d0a7c8
-
Filesize
132KB
MD5b98921807208b62b83b57adbd7a0bf8a
SHA1cc641b5bb417e22a29c4303fdbe277cfd7cfbbc6
SHA2561f699113a3ad51fd842c8ecfc4b225ed5a564e6c8f4a5c96092433e58d9390fa
SHA512b02d243810e9fc1f8e1dad831be8066c35be061c5dd7dc7676c31fe3d851b3fc292837bae318fc3b8b758f0deda84a072892058153bf96a5ada062f860d0a7c8
-
Filesize
132KB
MD5b98921807208b62b83b57adbd7a0bf8a
SHA1cc641b5bb417e22a29c4303fdbe277cfd7cfbbc6
SHA2561f699113a3ad51fd842c8ecfc4b225ed5a564e6c8f4a5c96092433e58d9390fa
SHA512b02d243810e9fc1f8e1dad831be8066c35be061c5dd7dc7676c31fe3d851b3fc292837bae318fc3b8b758f0deda84a072892058153bf96a5ada062f860d0a7c8