Analysis
-
max time kernel
11s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2022 07:18
Static task
static1
Behavioral task
behavioral1
Sample
09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe
Resource
win10v2004-20220901-en
General
-
Target
09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe
-
Size
424KB
-
MD5
77524130a695886729d39028a0540b30
-
SHA1
5282ecada34607c247d9579abf6e8afc37ec45f8
-
SHA256
09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444
-
SHA512
ac1775c2155c498ec411ba39d0d1a9a4488b1047e2939fbd1ec5eb62788fb1f77ece800ca22435601459d4332f0e8577a091efe7d6b60689c292d837451da140
-
SSDEEP
12288:XqEXeMVG+C7QP2sFZ1u2iW4ZJSPhgYblCJxfS6:aEXeCG+uOLFDId2PhggOR1
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\_RECoVERY_+dijgx.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E05325F9A1797090
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E05325F9A1797090
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/E05325F9A1797090
http://xlowfznrg4wf7dli.ONION/E05325F9A1797090
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 5048 kbnuarqoykmn.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation kbnuarqoykmn.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run kbnuarqoykmn.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tjjweaxdqhbn = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\kbnuarqoykmn.exe\"" kbnuarqoykmn.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\az.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\History.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt kbnuarqoykmn.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt kbnuarqoykmn.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\kbnuarqoykmn.exe 09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe File created C:\Windows\kbnuarqoykmn.exe 09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe 5048 kbnuarqoykmn.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 1284 09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe Token: SeDebugPrivilege 5048 kbnuarqoykmn.exe Token: SeIncreaseQuotaPrivilege 1444 WMIC.exe Token: SeSecurityPrivilege 1444 WMIC.exe Token: SeTakeOwnershipPrivilege 1444 WMIC.exe Token: SeLoadDriverPrivilege 1444 WMIC.exe Token: SeSystemProfilePrivilege 1444 WMIC.exe Token: SeSystemtimePrivilege 1444 WMIC.exe Token: SeProfSingleProcessPrivilege 1444 WMIC.exe Token: SeIncBasePriorityPrivilege 1444 WMIC.exe Token: SeCreatePagefilePrivilege 1444 WMIC.exe Token: SeBackupPrivilege 1444 WMIC.exe Token: SeRestorePrivilege 1444 WMIC.exe Token: SeShutdownPrivilege 1444 WMIC.exe Token: SeDebugPrivilege 1444 WMIC.exe Token: SeSystemEnvironmentPrivilege 1444 WMIC.exe Token: SeRemoteShutdownPrivilege 1444 WMIC.exe Token: SeUndockPrivilege 1444 WMIC.exe Token: SeManageVolumePrivilege 1444 WMIC.exe Token: 33 1444 WMIC.exe Token: 34 1444 WMIC.exe Token: 35 1444 WMIC.exe Token: 36 1444 WMIC.exe Token: SeIncreaseQuotaPrivilege 1444 WMIC.exe Token: SeSecurityPrivilege 1444 WMIC.exe Token: SeTakeOwnershipPrivilege 1444 WMIC.exe Token: SeLoadDriverPrivilege 1444 WMIC.exe Token: SeSystemProfilePrivilege 1444 WMIC.exe Token: SeSystemtimePrivilege 1444 WMIC.exe Token: SeProfSingleProcessPrivilege 1444 WMIC.exe Token: SeIncBasePriorityPrivilege 1444 WMIC.exe Token: SeCreatePagefilePrivilege 1444 WMIC.exe Token: SeBackupPrivilege 1444 WMIC.exe Token: SeRestorePrivilege 1444 WMIC.exe Token: SeShutdownPrivilege 1444 WMIC.exe Token: SeDebugPrivilege 1444 WMIC.exe Token: SeSystemEnvironmentPrivilege 1444 WMIC.exe Token: SeRemoteShutdownPrivilege 1444 WMIC.exe Token: SeUndockPrivilege 1444 WMIC.exe Token: SeManageVolumePrivilege 1444 WMIC.exe Token: 33 1444 WMIC.exe Token: 34 1444 WMIC.exe Token: 35 1444 WMIC.exe Token: 36 1444 WMIC.exe Token: SeBackupPrivilege 4228 vssvc.exe Token: SeRestorePrivilege 4228 vssvc.exe Token: SeAuditPrivilege 4228 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1284 wrote to memory of 5048 1284 09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe 85 PID 1284 wrote to memory of 5048 1284 09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe 85 PID 1284 wrote to memory of 5048 1284 09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe 85 PID 1284 wrote to memory of 4212 1284 09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe 87 PID 1284 wrote to memory of 4212 1284 09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe 87 PID 1284 wrote to memory of 4212 1284 09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe 87 PID 5048 wrote to memory of 1444 5048 kbnuarqoykmn.exe 89 PID 5048 wrote to memory of 1444 5048 kbnuarqoykmn.exe 89 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" kbnuarqoykmn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System kbnuarqoykmn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe"C:\Users\Admin\AppData\Local\Temp\09f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\kbnuarqoykmn.exeC:\Windows\kbnuarqoykmn.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5048 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\09F36A~1.EXE2⤵PID:4212
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4228
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
424KB
MD577524130a695886729d39028a0540b30
SHA15282ecada34607c247d9579abf6e8afc37ec45f8
SHA25609f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444
SHA512ac1775c2155c498ec411ba39d0d1a9a4488b1047e2939fbd1ec5eb62788fb1f77ece800ca22435601459d4332f0e8577a091efe7d6b60689c292d837451da140
-
Filesize
424KB
MD577524130a695886729d39028a0540b30
SHA15282ecada34607c247d9579abf6e8afc37ec45f8
SHA25609f36ab633d5ecc1b59034f35d11bf3bd3507c780f9afea683dce83627c2a444
SHA512ac1775c2155c498ec411ba39d0d1a9a4488b1047e2939fbd1ec5eb62788fb1f77ece800ca22435601459d4332f0e8577a091efe7d6b60689c292d837451da140