Overview

overview

8

Static

static

d6638e855e...ff.exe

windows7-x64

8

d6638e855e...ff.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-10-2022 18:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d6638e855eada622652693f11c2c1a2b0c3cb71ad9a723d02378f15189ae09ff.exe

  • Size

    793KB

  • MD5

    681dbc8305876e960d3fb5a903fe9def

  • SHA1

    5d3fccb12fe564431a02a34dda6e2a67c5ae57a8

  • SHA256

    d6638e855eada622652693f11c2c1a2b0c3cb71ad9a723d02378f15189ae09ff

  • SHA512

    60ae16e1b3d95c2f3478f7da44e247ca2077be064d626622780bfe1e070ae5974b690b3dbc280b4b210704af264a81329bd94035a69e2a39f9550fe663f97398

  • SSDEEP

    24576:KvSVfZApBOr1sU6uEgjhlOCDw8mEFAuYg2OWpTMqBx+fdTmG2Y4MT9ffD+CzKcb3:XApBOr1sU6uEgjhlOCDw8mEFAuYg2OWm

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6638e855eada622652693f11c2c1a2b0c3cb71ad9a723d02378f15189ae09ff.exe
    "C:\Users\Admin\AppData\Local\Temp\d6638e855eada622652693f11c2c1a2b0c3cb71ad9a723d02378f15189ae09ff.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "wsappx" /tr "C:\Users\Static\wsappx.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4928
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp6FC6.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp6FC6.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\system32\tasklist.exe
        Tasklist /fi "PID eq 3032"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
      • C:\Windows\system32\find.exe
        find ":"
        3⤵
          PID:3684
        • C:\Windows\system32\timeout.exe
          Timeout /T 1 /Nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:4488
        • C:\Users\Static\wsappx.exe
          "wsappx.exe"
          3⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4592
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "wsappx" /tr "C:\Users\Static\wsappx.exe"
            4⤵
            • Creates scheduled task(s)
            PID:5052

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp6FC6.tmp.bat
      Filesize

      242B

      MD5

      985bdf45494478d9f695eca898b1d040

      SHA1

      d6865dd78278f43abef53f09f61b6fb520478408

      SHA256

      51d4301f3b68b589a9e4023ea691d34eb90b011460ff3270f94eb8585b0df39f

      SHA512

      f7561d9870d9006d88361c2f8da0fc496280af59a23601f5135c33a7370db79e6163955e5338f0b2d5ea71c4f51576bce6d74430ff41d0fbc92d6c2ee2cda750

      Download Submit

    • C:\Users\Static\wsappx.exe
      Filesize

      793KB

      MD5

      681dbc8305876e960d3fb5a903fe9def

      SHA1

      5d3fccb12fe564431a02a34dda6e2a67c5ae57a8

      SHA256

      d6638e855eada622652693f11c2c1a2b0c3cb71ad9a723d02378f15189ae09ff

      SHA512

      60ae16e1b3d95c2f3478f7da44e247ca2077be064d626622780bfe1e070ae5974b690b3dbc280b4b210704af264a81329bd94035a69e2a39f9550fe663f97398

      Download Submit

    • C:\Users\Static\wsappx.exe
      Filesize

      793KB

      MD5

      681dbc8305876e960d3fb5a903fe9def

      SHA1

      5d3fccb12fe564431a02a34dda6e2a67c5ae57a8

      SHA256

      d6638e855eada622652693f11c2c1a2b0c3cb71ad9a723d02378f15189ae09ff

      SHA512

      60ae16e1b3d95c2f3478f7da44e247ca2077be064d626622780bfe1e070ae5974b690b3dbc280b4b210704af264a81329bd94035a69e2a39f9550fe663f97398

      Download Submit

    • memory/3032-132-0x0000014611900000-0x00000146119CC000-memory.dmp

      Filesize

      816KB

      Download

    • memory/3032-133-0x00007FFA66FE0000-0x00007FFA67AA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3032-138-0x00007FFA66FE0000-0x00007FFA67AA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4592-144-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4592-146-0x00007FFA67360000-0x00007FFA67E21000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4592-147-0x000001FD73B30000-0x000001FD73BA6000-memory.dmp

      Filesize

      472KB

      Download

    • memory/4592-148-0x000001FD73C60000-0x000001FD73D0A000-memory.dmp

      Filesize

      680KB

      Download