Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2022 02:13
Static task
static1
Behavioral task
behavioral1
Sample
f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe
Resource
win10v2004-20220901-en
General
-
Target
f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe
-
Size
92KB
-
MD5
775c26941957e1b656e0702cb49f6330
-
SHA1
8d413d656ff1852e7d5c6fb60c68491a9bd25ea4
-
SHA256
f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826
-
SHA512
e97a57aed32b3c399849bd4617c8f7a6cb2854dd296e1a6a99ec28dcf241ca0afcffb8ef1478b2052ad92a769bb9654cee97166fa24dd8983b3148de797e9204
-
SSDEEP
1536:t6O09qqlmZSQ/bYe0g/ICs+6kzYZVpekZKB0gOEeQGn:t7qlmZSQ/bYPg/ICs+FCVpekZKBMLVn
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 848 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 848 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5016 f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5016 wrote to memory of 3592 5016 f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe 83 PID 5016 wrote to memory of 3592 5016 f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe 83 PID 5016 wrote to memory of 3592 5016 f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe 83 PID 3592 wrote to memory of 848 3592 cmd.exe 85 PID 3592 wrote to memory of 848 3592 cmd.exe 85 PID 3592 wrote to memory of 848 3592 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe"C:\Users\Admin\AppData\Local\Temp\f61230ad4d21e0e4c9a7aa3ebd938402df9cf3f26040837fbfc09a216f2f8826.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del f61230ad4d21e0e4c9a7aa3ebd938402df2⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:848
-
-