a52ad50c2487aee8da9e4e9bc51dfedd293bd4c7fbf966297f6da63b11abacf2

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2022, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24fe1a3662a0e663a0f75066c3e0c98f.exe
Size 10KB
Sample221015-g52rcafcd7
SHA256 a52ad50c2487aee8da9e4e9bc51dfedd293bd4c7fbf966297f6da63b11abacf2
MD5 24fe1a3662a0e663a0f75066c3e0c98f
SHA1 b1fa84d4d0fb58cc22f2fa6351f6f38dfb9e622e
SHA512 665cc1402e0e96b1c4e180977f3601df5af679d383496df98da1f734d33f3af1fc93dc0693cff72772926c50dd5ba1cb780012d4bf61ae5859db6bc0ad032d80
SSDEEP 96:WTKZXS33L/KTPZzxlHDsxhqcgh8VqtPn9Vqvv55/+B1P9BqfzNt:ir3L/K9xixhqcgh8V2PnHuqvBE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2732	24fe1a3662a0e663a0f75066c3e0c98f.exe
4104	24fe1a3662a0e663a0f75066c3e0c98f.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	24fe1a3662a0e663a0f75066c3e0c98f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	24fe1a3662a0e663a0f75066c3e0c98f.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 2996	4988	24fe1a3662a0e663a0f75066c3e0c98f.exe	92
PID 2732 set thread context of 4104	2732	24fe1a3662a0e663a0f75066c3e0c98f.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
864	powershell.exe
864	powershell.exe
4988	24fe1a3662a0e663a0f75066c3e0c98f.exe
4988	24fe1a3662a0e663a0f75066c3e0c98f.exe
4616	powershell.exe
4616	powershell.exe
2732	24fe1a3662a0e663a0f75066c3e0c98f.exe
2732	24fe1a3662a0e663a0f75066c3e0c98f.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	24fe1a3662a0e663a0f75066c3e0c98f.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	2996	24fe1a3662a0e663a0f75066c3e0c98f.exe
Token: SeDebugPrivilege	2732	24fe1a3662a0e663a0f75066c3e0c98f.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	4104	24fe1a3662a0e663a0f75066c3e0c98f.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 864	4988	24fe1a3662a0e663a0f75066c3e0c98f.exe	83
PID 4988 wrote to memory of 864	4988	24fe1a3662a0e663a0f75066c3e0c98f.exe	83
PID 4988 wrote to memory of 2996	4988	24fe1a3662a0e663a0f75066c3e0c98f.exe	92
PID 4988 wrote to memory of 2996	4988	24fe1a3662a0e663a0f75066c3e0c98f.exe	92
PID 4988 wrote to memory of 2996	4988	24fe1a3662a0e663a0f75066c3e0c98f.exe	92
PID 4988 wrote to memory of 2996	4988	24fe1a3662a0e663a0f75066c3e0c98f.exe	92
PID 4988 wrote to memory of 2996	4988	24fe1a3662a0e663a0f75066c3e0c98f.exe	92
PID 4988 wrote to memory of 2996	4988	24fe1a3662a0e663a0f75066c3e0c98f.exe	92
PID 2732 wrote to memory of 4616	2732	24fe1a3662a0e663a0f75066c3e0c98f.exe	94
PID 2732 wrote to memory of 4616	2732	24fe1a3662a0e663a0f75066c3e0c98f.exe	94
PID 2732 wrote to memory of 4104	2732	24fe1a3662a0e663a0f75066c3e0c98f.exe	96
PID 2732 wrote to memory of 4104	2732	24fe1a3662a0e663a0f75066c3e0c98f.exe	96
PID 2732 wrote to memory of 4104	2732	24fe1a3662a0e663a0f75066c3e0c98f.exe	96
PID 2732 wrote to memory of 4104	2732	24fe1a3662a0e663a0f75066c3e0c98f.exe	96
PID 2732 wrote to memory of 4104	2732	24fe1a3662a0e663a0f75066c3e0c98f.exe	96
PID 2732 wrote to memory of 4104	2732	24fe1a3662a0e663a0f75066c3e0c98f.exe	96

C:\Users\Admin\AppData\Local\Temp\24fe1a3662a0e663a0f75066c3e0c98f.exe
"C:\Users\Admin\AppData\Local\Temp\24fe1a3662a0e663a0f75066c3e0c98f.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:864
- C:\Users\Admin\AppData\Local\Temp\24fe1a3662a0e663a0f75066c3e0c98f.exe
  C:\Users\Admin\AppData\Local\Temp\24fe1a3662a0e663a0f75066c3e0c98f.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2996

C:\Users\Admin\AppData\Roaming\24fe1a3662a0e663a0f75066c3e0c98f.exe
C:\Users\Admin\AppData\Roaming\24fe1a3662a0e663a0f75066c3e0c98f.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Users\Admin\AppData\Roaming\24fe1a3662a0e663a0f75066c3e0c98f.exe
  C:\Users\Admin\AppData\Roaming\24fe1a3662a0e663a0f75066c3e0c98f.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24fe1a3662a0e663a0f75066c3e0c98f.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\24fe1a3662a0e663a0f75066c3e0c98f.exe.log
Size 1KB
SHA256 d063952c091e25214469458e65b33da9ef9b413ede9cc2b8a5c28970bb1a5b69
MD5 165bccf3bb1841eaf1a73ff52d65f59e
SHA1 8450f78886ff5ee9f0a1590582ed455624ae7eca
SHA512 519d9ffd811bea83a16c234e25172ea186932c45b7004a309d536d0b3b465cc9c3409afc0fdf481fa215a395e305bbb5f2e209f6e0139875d710f23ff38fd5a4
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ffc29461bd43b0ffffa1c06c260f5089cce205cab26a1a1032b924272b718205
MD5 2b856bda56945fa7252034b16c0189f0
SHA1 df2d4ff8394cc57a8c399bfb5602679bfdcde06b
SHA512 8843b6d91163d345e2aded8143d941388852ed3d4aa39ced89a3cf8a50bb908681624a7008c0b82359736cc3222f7908a1c34442028491921d243c0581aeb3e9
MD5 SHA1 SHA512

Submit Download

24fe1a3662a0e663a0f75066c3e0c98f.exe

Path C:\Users\Admin\AppData\Roaming\24fe1a3662a0e663a0f75066c3e0c98f.exe
Size 10KB
SHA256 a52ad50c2487aee8da9e4e9bc51dfedd293bd4c7fbf966297f6da63b11abacf2
MD5 24fe1a3662a0e663a0f75066c3e0c98f
SHA1 b1fa84d4d0fb58cc22f2fa6351f6f38dfb9e622e
SHA512 665cc1402e0e96b1c4e180977f3601df5af679d383496df98da1f734d33f3af1fc93dc0693cff72772926c50dd5ba1cb780012d4bf61ae5859db6bc0ad032d80
SSDEEP 96:WTKZXS33L/KTPZzxlHDsxhqcgh8VqtPn9Vqvv55/+B1P9BqfzNt:ir3L/K9xixhqcgh8V2PnHuqvBE
MD5 SHA1 SHA512 SSDEEP

Submit Download

24fe1a3662a0e663a0f75066c3e0c98f.exe

Path C:\Users\Admin\AppData\Roaming\24fe1a3662a0e663a0f75066c3e0c98f.exe
Size 10KB
SHA256 a52ad50c2487aee8da9e4e9bc51dfedd293bd4c7fbf966297f6da63b11abacf2
MD5 24fe1a3662a0e663a0f75066c3e0c98f
SHA1 b1fa84d4d0fb58cc22f2fa6351f6f38dfb9e622e
SHA512 665cc1402e0e96b1c4e180977f3601df5af679d383496df98da1f734d33f3af1fc93dc0693cff72772926c50dd5ba1cb780012d4bf61ae5859db6bc0ad032d80
SSDEEP 96:WTKZXS33L/KTPZzxlHDsxhqcgh8VqtPn9Vqvv55/+B1P9BqfzNt:ir3L/K9xixhqcgh8V2PnHuqvBE
MD5 SHA1 SHA512 SSDEEP

Submit Download

24fe1a3662a0e663a0f75066c3e0c98f.exe

Path C:\Users\Admin\AppData\Roaming\24fe1a3662a0e663a0f75066c3e0c98f.exe
Size 10KB
SHA256 a52ad50c2487aee8da9e4e9bc51dfedd293bd4c7fbf966297f6da63b11abacf2
MD5 24fe1a3662a0e663a0f75066c3e0c98f
SHA1 b1fa84d4d0fb58cc22f2fa6351f6f38dfb9e622e
SHA512 665cc1402e0e96b1c4e180977f3601df5af679d383496df98da1f734d33f3af1fc93dc0693cff72772926c50dd5ba1cb780012d4bf61ae5859db6bc0ad032d80
SSDEEP 96:WTKZXS33L/KTPZzxlHDsxhqcgh8VqtPn9Vqvv55/+B1P9BqfzNt:ir3L/K9xixhqcgh8V2PnHuqvBE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/864-138-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/864-139-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/864-136-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/2732-154-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/2732-149-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/2732-160-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/2996-140-0x0000000140000000-0x000000014007A000-memory.dmp

Download

memory/2996-144-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/2996-145-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/2996-148-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/4104-162-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/4104-161-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/4616-155-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/4616-156-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/4616-152-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/4988-133-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/4988-143-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/4988-137-0x00007FF996CD0000-0x00007FF997791000-memory.dmp

Download

memory/4988-134-0x00000200509E0000-0x0000020050A02000-memory.dmp

Download

memory/4988-132-0x000002004EDE0000-0x000002004EDE6000-memory.dmp

Download