Analysis
-
max time kernel
178s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
082468775e71a0573a6d1b7b9707b223.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
082468775e71a0573a6d1b7b9707b223.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
082468775e71a0573a6d1b7b9707b223.exe
-
Size
186KB
-
MD5
082468775e71a0573a6d1b7b9707b223
-
SHA1
f505f7bf8fd71f4fd520734e97b2dcd0a0363ed0
-
SHA256
1931ee3bb9562721ab65d6643d51c2b37879ed3347c1e96a3d27865c8e3d355a
-
SHA512
f73109d944266e4be46a6829e3eb07fa7210b6a0f310e2a5d2a45955b780a223a5fc9b9a11cfe56eddc6b775dff9f181c6e3be8929c74475ec3e933039373079
-
SSDEEP
3072:PAUr6milNYXJb3r7lkKgy6bgXBA8Ug6JPaJHiTsPrcqZH2FZxzqY6FKVwgeYENV:4h7iXJb3f8RgbUJCAuH2FZRqY6FKVwgq
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1856 svchost.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4988 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 082468775e71a0573a6d1b7b9707b223.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9f142b90526f8362621e21d115640fc1.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9f142b90526f8362621e21d115640fc1.exe svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9f142b90526f8362621e21d115640fc1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9f142b90526f8362621e21d115640fc1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf svchost.exe File opened for modification C:\autorun.inf svchost.exe File created D:\autorun.inf svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 392 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1856 svchost.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 1856 svchost.exe Token: SeDebugPrivilege 392 taskkill.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe Token: 33 1856 svchost.exe Token: SeIncBasePriorityPrivilege 1856 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2160 wrote to memory of 1856 2160 082468775e71a0573a6d1b7b9707b223.exe 89 PID 2160 wrote to memory of 1856 2160 082468775e71a0573a6d1b7b9707b223.exe 89 PID 2160 wrote to memory of 1856 2160 082468775e71a0573a6d1b7b9707b223.exe 89 PID 1856 wrote to memory of 4988 1856 svchost.exe 90 PID 1856 wrote to memory of 4988 1856 svchost.exe 90 PID 1856 wrote to memory of 4988 1856 svchost.exe 90 PID 1856 wrote to memory of 392 1856 svchost.exe 92 PID 1856 wrote to memory of 392 1856 svchost.exe 92 PID 1856 wrote to memory of 392 1856 svchost.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\082468775e71a0573a6d1b7b9707b223.exe"C:\Users\Admin\AppData\Local\Temp\082468775e71a0573a6d1b7b9707b223.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:4988
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM AvastUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:392
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186KB
MD5082468775e71a0573a6d1b7b9707b223
SHA1f505f7bf8fd71f4fd520734e97b2dcd0a0363ed0
SHA2561931ee3bb9562721ab65d6643d51c2b37879ed3347c1e96a3d27865c8e3d355a
SHA512f73109d944266e4be46a6829e3eb07fa7210b6a0f310e2a5d2a45955b780a223a5fc9b9a11cfe56eddc6b775dff9f181c6e3be8929c74475ec3e933039373079
-
Filesize
186KB
MD5082468775e71a0573a6d1b7b9707b223
SHA1f505f7bf8fd71f4fd520734e97b2dcd0a0363ed0
SHA2561931ee3bb9562721ab65d6643d51c2b37879ed3347c1e96a3d27865c8e3d355a
SHA512f73109d944266e4be46a6829e3eb07fa7210b6a0f310e2a5d2a45955b780a223a5fc9b9a11cfe56eddc6b775dff9f181c6e3be8929c74475ec3e933039373079