326628b6afc679ebb166efee5fd2eb60bf8e266ce88d1e5d1924d74556479be0

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
098765678.exe
Size 1.9MB
Sample221025-299b7sebd9
SHA256 326628b6afc679ebb166efee5fd2eb60bf8e266ce88d1e5d1924d74556479be0
MD5 53eaad4bb8361394f20e54dd95770257
SHA1 2e048eb2b1049a232a87883c6c545b8df3f335ff
SHA512 827612a1ce786a46910f6c1f3a3ebf3768aa64828c91873973a6c6e213008df3e2a83ed8008ebb373e7bf92eaefd20aaee6bbd7469133580ba27998a4d72747a
SSDEEP 24576:GAOcZv+YAO7wuj1RFOm840y1HXBIEws9siu5s7chBukBLaCZ73QqQ5SOb2eYz1e:sb8j/FG40sX33GHgci2LBbJNzU
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2320	aiwuhwja.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	098765678.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	aiwuhwja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5_106\\aiwuhwja.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\5_106\\BXDVNQ~1.TID"	aiwuhwja.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 5036	2320	aiwuhwja.exe	93
PID 2320 set thread context of 4984	2320	aiwuhwja.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	098765678.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5036	RegSvcs.exe
5036	RegSvcs.exe
4984	RegSvcs.exe
4984	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3324	3044	098765678.exe	84
PID 3044 wrote to memory of 3324	3044	098765678.exe	84
PID 3044 wrote to memory of 3324	3044	098765678.exe	84
PID 3324 wrote to memory of 2320	3324	WScript.exe	87
PID 3324 wrote to memory of 2320	3324	WScript.exe	87
PID 3324 wrote to memory of 2320	3324	WScript.exe	87
PID 2320 wrote to memory of 4984	2320	aiwuhwja.exe	92
PID 2320 wrote to memory of 4984	2320	aiwuhwja.exe	92
PID 2320 wrote to memory of 4984	2320	aiwuhwja.exe	92
PID 2320 wrote to memory of 5036	2320	aiwuhwja.exe	93
PID 2320 wrote to memory of 5036	2320	aiwuhwja.exe	93
PID 2320 wrote to memory of 5036	2320	aiwuhwja.exe	93
PID 2320 wrote to memory of 5036	2320	aiwuhwja.exe	93
PID 2320 wrote to memory of 5036	2320	aiwuhwja.exe	93
PID 2320 wrote to memory of 5036	2320	aiwuhwja.exe	93
PID 2320 wrote to memory of 5036	2320	aiwuhwja.exe	93
PID 2320 wrote to memory of 5036	2320	aiwuhwja.exe	93
PID 2320 wrote to memory of 5036	2320	aiwuhwja.exe	93
PID 2320 wrote to memory of 4984	2320	aiwuhwja.exe	92
PID 2320 wrote to memory of 4984	2320	aiwuhwja.exe	92

C:\Users\Admin\AppData\Local\Temp\098765678.exe
"C:\Users\Admin\AppData\Local\Temp\098765678.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\5_106\tvmpfhmx.vbe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Users\Admin\AppData\Local\Temp\5_106\aiwuhwja.exe
    "C:\Users\Admin\AppData\Local\Temp\5_106\aiwuhwja.exe" bxdvnqdnl.tid
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4984
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aiwuhwja.exe

Path C:\Users\Admin\AppData\Local\Temp\5_106\aiwuhwja.exe
Size 1.4MB
SHA256 65245f49d84a11d455489404fe719e7db16fa3b43683742d972d703fadcf9d69
MD5 e8cf385433598106a855130785a7d4f8
SHA1 82748389ac02500c4dbf8ae781012e6c39c069f8
SHA512 33afb515fdcefb0ce50e3336c70cd23d243e32dd33f31243183f95317750b36437d406712d35ed3aa82300d985d81f4364e285a90bd9ea7a4b87cfc1bebae840
SSDEEP 24576:0ErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a4ck6Z:086pqeE74aB0Sdia4+Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

aiwuhwja.exe

Path C:\Users\Admin\AppData\Local\Temp\5_106\aiwuhwja.exe
Size 1.4MB
SHA256 65245f49d84a11d455489404fe719e7db16fa3b43683742d972d703fadcf9d69
MD5 e8cf385433598106a855130785a7d4f8
SHA1 82748389ac02500c4dbf8ae781012e6c39c069f8
SHA512 33afb515fdcefb0ce50e3336c70cd23d243e32dd33f31243183f95317750b36437d406712d35ed3aa82300d985d81f4364e285a90bd9ea7a4b87cfc1bebae840
SSDEEP 24576:0ErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a4ck6Z:086pqeE74aB0Sdia4+Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

bxdvnqdnl.tid

Path C:\Users\Admin\AppData\Local\Temp\5_106\bxdvnqdnl.tid
Size 224.7MB
SHA256 283d4e953c313c66e34591e970b4c9aa19ca85663937e95fd0dc98c32d622ad7
MD5 00e69d85b37ab55467174d6aeb32c963
SHA1 09cf49ff666e1c74903918a6ebbf29d5353badcc
SHA512 c499c40850d490cc01a8d2c7db027d76e676e4583db6fdb35a2074d766432b55cc6c7c25320cc65369eb2b5d7e7570802dec40a7a62d6b681e6edd11742eb03e
SSDEEP 3145728:+2SLvdrOWb2+Y7b1Xjalp4UnFMQdOpGDYWKiPVnOCOlSd/cE1MTI5kHI01xKVZ9r:o
MD5 SHA1 SHA512 SSDEEP

Submit Download

fdhsrliq.dll

Path C:\Users\Admin\AppData\Local\Temp\5_106\fdhsrliq.dll
Size 59KB
SHA256 c16dbff75d6dbe45d7edd93dd6c73e4b51414c64309cd2e18e2f6f559c16a54f
MD5 20cc8f0a71db1eed6947769b434f151b
SHA1 939c7c688418b4bc8e276b2726c894de448f87fc
SHA512 ba28a88bbd706f58d2171a669df7b0f1b7bb971ed362a6030b440fdbb7421840dc0e0874a458e496d58106921a2c1ed8b089ed6e168f1bc5eaa7a78a8d4e62a5
SSDEEP 1536:KaiD4fDxdw86uA+HnyQpDqOKbBf4WyXcsTTVYXZE3nUO1B9do3W:7FjZLxqrbBEceTV8ZEt1fdo3W
MD5 SHA1 SHA512 SSDEEP

Submit Download

taaifvvh.dmt

Path C:\Users\Admin\AppData\Local\Temp\5_106\taaifvvh.dmt
Size 984KB
SHA256 1b5a2363e5308228f540d3e128896e4da70fed600434f6321194399acc4243f4
MD5 0201c5a47f80bc5140707e6ad6ae3e99
SHA1 886a984c748fd8895ce4209de06506a2c9d4ad2a
SHA512 73353b9b94d8369fd3f049ba3c26898e85f7ac3fb8e9e01ce787f07e4abb7df969ef2a4e56abb971b9fd9b52d194e142f07108f3dc683e92ab27b40dd948accb
SSDEEP 12288:TeBUgtJWSs2PuFO7PzOOs17ykBiXX92rNPSHcSj0VmhAg/3et:TeaUn3PuCRSy4id2rNcPSo3et
MD5 SHA1 SHA512 SSDEEP

Submit Download

tvmpfhmx.vbe

Path C:\Users\Admin\AppData\Local\temp\5_106\tvmpfhmx.vbe
Size 20KB
SHA256 052e906e2580feb259d1b5ef7f2f8ccddf1990e0224e86e49f80ec783f44327c
MD5 67297f8f95eff1bc5d9ff1d1a6738c23
SHA1 bc962089c655c7d6b536c6c929bb159ca76a9a9a
SHA512 ba16214a62d502bcb44f3e3540c70108e2eb0f2d0f724984985e8e8eb3cf72e3f11a22221347375188a54d9b8953e3400163ed26ee71bc4b9da5a5645eed9f19
SSDEEP 384:6qz7NTNAqz7NTN6qz7NTNDqz7NTNBqz7NTNt:VbtAul
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4984-149-0x0000000000400000-0x000000000090D000-memory.dmp

Download

memory/4984-156-0x0000000000400000-0x000000000090D000-memory.dmp

Download

memory/4984-143-0x0000000000400000-0x000000000090D000-memory.dmp

Download

memory/4984-155-0x0000000000400000-0x000000000090D000-memory.dmp

Download

memory/5036-153-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5036-144-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5036-141-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads