544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352

Analysis

max time kernel
148s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe
Size

336KB
MD5

41bdbf477b31e57c8feee1bd8479cdb0
SHA1

e9e5b91971bdbbe68c6238ac0eaa529440cd944e
SHA256

544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352
SHA512

e2cd23e2a4b691513a05d827b3d7e88d1142ac4ec04403835d9715f25e61278dc61b04e46a79a0cdec6395fe4416bb961ddb81b7fe18722a0308b453d658f51b
SSDEEP

6144:XqwXsTcNUXc8vtBgANFGBg6HOMFPZfQiQyWCGR8iyfUInjxxaf1Uri4:Xqwcoavt2AfORFGCzVciS+r

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1424	RunMgr.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\RunMgr.EXE	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3824	1424	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1468	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1424	1468	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	83
PID 1468 wrote to memory of 1424	1468	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	83
PID 1468 wrote to memory of 1424	1468	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	83
PID 1468 wrote to memory of 400	1468	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	84
PID 1468 wrote to memory of 400	1468	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	84
PID 1468 wrote to memory of 400	1468	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	84
PID 1468 wrote to memory of 2696	1468	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	86
PID 1468 wrote to memory of 2696	1468	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	86
PID 1468 wrote to memory of 2696	1468	544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe	86

C:\Users\Admin\AppData\Local\Temp\544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe
"C:\Users\Admin\AppData\Local\Temp\544d18393465b23267db862542f8aa23f6f8a4dfc3c4dec4f86e96478b88f352.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\RunMgr.EXE
  "C:\Windows\RunMgr.EXE"
  2⤵
  - Executes dropped EXE
  PID:1424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 224
    3⤵
    - Program crash
    PID:3824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del %SystemRoot%\Debug.exe
  2⤵
  PID:400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\544D18~1.EXE > nul
  2⤵
  PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1424 -ip 1424
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\RunMgr.EXE

Filesize
268KB

MD5
c17e648345690c4648a70adb87208388

SHA1
a778992b560699f307e2af982a37be3a0a80005b

SHA256
947b00ed4929668d80c203e898f68e9c19c153577831afc2d43fa1db5548a148

SHA512
b18d835462b8309b8e418ff7f7e4c059a6e239fdd56c193542be6ceab5dcdb52196b9ca97d07be409ffa92ddd4073309466741222f7911a1f39094d90be48737

Download Submit
C:\Windows\RunMgr.EXE

Filesize
268KB

MD5
c17e648345690c4648a70adb87208388

SHA1
a778992b560699f307e2af982a37be3a0a80005b

SHA256
947b00ed4929668d80c203e898f68e9c19c153577831afc2d43fa1db5548a148

SHA512
b18d835462b8309b8e418ff7f7e4c059a6e239fdd56c193542be6ceab5dcdb52196b9ca97d07be409ffa92ddd4073309466741222f7911a1f39094d90be48737

Download Submit
memory/1424-138-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1468-132-0x0000000000400000-0x000000000045564E-memory.dmp

Filesize
341KB

Download
memory/1468-139-0x0000000000400000-0x000000000045564E-memory.dmp

Filesize
341KB

Download