Analysis

  • max time kernel
    585s
  • max time network
    588s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-de
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-delocale:de-deos:windows10-2004-x64systemwindows
  • submitted
    15-10-2022 22:26

General

  • Target

    9ed0f76449bbc6d5d6db12dfc527740c072436c4379248855729321032d91bb7.exe

  • Size

    162KB

  • MD5

    b08793eadfa6dd535f68e4f67c43e5c0

  • SHA1

    f952c86957f37022ce8ba1cab0c02fb262b74f76

  • SHA256

    9ed0f76449bbc6d5d6db12dfc527740c072436c4379248855729321032d91bb7

  • SHA512

    62ad843c1c98dd270bddba6ff73022e2eae00ff5fcebb93b51e1b63da21fc1ae3124e11c063c655e8c3a13dda070bc25c9db20efbda556a397a294f49a9b3f63

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 2 IoCs
  • Checks computer location settings ⋅ 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash ⋅ 1 IoCs
  • Checks processor information in registry ⋅ 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) ⋅ 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 4 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ed0f76449bbc6d5d6db12dfc527740c072436c4379248855729321032d91bb7.exe
    "C:\Users\Admin\AppData\Local\Temp\9ed0f76449bbc6d5d6db12dfc527740c072436c4379248855729321032d91bb7.exe"
    Checks computer location settings
    Checks processor information in registry
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:968
    • C:\Users\Admin\AppData\Roaming\loader.exe
      "C:\Users\Admin\AppData\Roaming\loader.exe"
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4904
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 5 /tn "Event Viewer Snap-in Launcher (29762912)" /tr "C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe"
        Creates scheduled task(s)
        PID:1808
      • C:\Windows\SysWOW64\schtasks.exe
        /C /Query /XML /TN "Event Viewer Snap-in Launcher (29762912)"
        PID:1052
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /tn "Event Viewer Snap-in Launcher (29762912)" /XML "C:\Users\Admin\AppData\Roaming\EventViewer\tfnme73946158264.tmp"
        Creates scheduled task(s)
        PID:4704
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 564
        Program crash
        PID:2720
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C timeout 5 & del "C:\Users\Admin\AppData\Local\Temp\9ed0f76449bbc6d5d6db12dfc527740c072436c4379248855729321032d91bb7.exe"
      Suspicious use of WriteProcessMemory
      PID:4940
      • C:\Windows\SysWOW64\timeout.exe
        timeout 5
        Delays execution with timeout.exe
        PID:4792
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4904 -ip 4904
    PID:1836
  • C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe
    C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe
    Executes dropped EXE
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 5 /tn "Event Viewer Snap-in Launcher (29762912)" /tr "C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe"
      Creates scheduled task(s)
      PID:1152

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                Privilege Escalation

                  Replay Monitor

                  00:00 00:00

                  Downloads

                  • C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe
                    MD5

                    2cf2c546825c42498eb5f0ff93cb773f

                    SHA1

                    ef1e8cb09aac78ff6b74be74d990611660a91b93

                    SHA256

                    8cb3436421ea4ccd17961ce733368eaa06f64d37bfee8f171eb7065092e0d3b4

                    SHA512

                    b808c1fa00e6f585906725271ae5eb6e1c31ac0b2264d9247ab2d56727510bf7df33fd827ef0564b01afe5b79a17995d7e1dbb9c8f510b2e2b21cf06d6cdb283

                  • C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe
                    MD5

                    2cf2c546825c42498eb5f0ff93cb773f

                    SHA1

                    ef1e8cb09aac78ff6b74be74d990611660a91b93

                    SHA256

                    8cb3436421ea4ccd17961ce733368eaa06f64d37bfee8f171eb7065092e0d3b4

                    SHA512

                    b808c1fa00e6f585906725271ae5eb6e1c31ac0b2264d9247ab2d56727510bf7df33fd827ef0564b01afe5b79a17995d7e1dbb9c8f510b2e2b21cf06d6cdb283

                  • C:\Users\Admin\AppData\Roaming\EventViewer\tfnme73946158264.tmp
                    MD5

                    8560aabf2e7699e09b9b153b3eb99c16

                    SHA1

                    2e03675c7e52cd073d7287d2557f1dc621a97f8c

                    SHA256

                    56dd9a449e8e6b2c0a01de95dd9c0f55fd7de29346f3d6e4689512392bc07a08

                    SHA512

                    bd819492c859cc429115a29ab74912afdad8280f749cf8c87f4e505b99a8909b354ff984f98ef1a19e69a06535f35cbd57e3ad5bb02ac58e200ed5244d799988

                  • C:\Users\Admin\AppData\Roaming\loader.exe
                    MD5

                    2cf2c546825c42498eb5f0ff93cb773f

                    SHA1

                    ef1e8cb09aac78ff6b74be74d990611660a91b93

                    SHA256

                    8cb3436421ea4ccd17961ce733368eaa06f64d37bfee8f171eb7065092e0d3b4

                    SHA512

                    b808c1fa00e6f585906725271ae5eb6e1c31ac0b2264d9247ab2d56727510bf7df33fd827ef0564b01afe5b79a17995d7e1dbb9c8f510b2e2b21cf06d6cdb283

                  • C:\Users\Admin\AppData\Roaming\loader.exe
                    MD5

                    2cf2c546825c42498eb5f0ff93cb773f

                    SHA1

                    ef1e8cb09aac78ff6b74be74d990611660a91b93

                    SHA256

                    8cb3436421ea4ccd17961ce733368eaa06f64d37bfee8f171eb7065092e0d3b4

                    SHA512

                    b808c1fa00e6f585906725271ae5eb6e1c31ac0b2264d9247ab2d56727510bf7df33fd827ef0564b01afe5b79a17995d7e1dbb9c8f510b2e2b21cf06d6cdb283

                  • memory/968-137-0x00000000750E0000-0x0000000075691000-memory.dmp
                  • memory/968-132-0x00000000750E0000-0x0000000075691000-memory.dmp
                  • memory/1052-142-0x0000000000000000-mapping.dmp
                  • memory/1152-149-0x0000000000000000-mapping.dmp
                  • memory/1808-140-0x0000000000000000-mapping.dmp
                  • memory/3084-148-0x0000000000130000-0x0000000000AB0000-memory.dmp
                  • memory/3084-150-0x0000000000130000-0x0000000000AB0000-memory.dmp
                  • memory/4704-143-0x0000000000000000-mapping.dmp
                  • memory/4792-138-0x0000000000000000-mapping.dmp
                  • memory/4904-141-0x00000000000C0000-0x0000000000A40000-memory.dmp
                  • memory/4904-139-0x00000000000C0000-0x0000000000A40000-memory.dmp
                  • memory/4904-145-0x00000000000C0000-0x0000000000A40000-memory.dmp
                  • memory/4904-133-0x0000000000000000-mapping.dmp
                  • memory/4940-136-0x0000000000000000-mapping.dmp