Analysis
-
max time kernel
601s -
max time network
485s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2022 05:11
Static task
static1
Behavioral task
behavioral1
Sample
1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe
Resource
win7-20220901-en
windows7-x64
10 signatures
600 seconds
Behavioral task
behavioral2
Sample
1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
600 seconds
General
-
Target
1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe
-
Size
228KB
-
MD5
f37f9160e2cf021983080ee0046529be
-
SHA1
65095a67c453db178b5735e7ecbeccbf1338ed75
-
SHA256
1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4
-
SHA512
e02014e203c776bf8f11ebd48dc9abf132a8a907fa87e21b0f37306b0924f56dce99af7ed5fbcd862b3c6173c7cf09335c2fc1d4edc6f5753bd16bfdbab2d5de
-
SSDEEP
3072:at02MzGJiEWNgZEYCATuvcurAVI0XN0bHJJ2yMUp7JaHVKFqa:bNNguNATkAVI0iLFMiIKFqa
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3192 tfijdyc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rcxwt = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Tfijdycf\\tfijdyc.exe\"" explorer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc tfijdyc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 tfijdyc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc tfijdyc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 tfijdyc.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3216 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1028 explorer.exe 1028 explorer.exe 4220 cmd.exe 4220 cmd.exe 4220 cmd.exe 4220 cmd.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe 1028 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3192 tfijdyc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe Token: SeDebugPrivilege 1028 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4980 wrote to memory of 3192 4980 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 83 PID 4980 wrote to memory of 3192 4980 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 83 PID 4980 wrote to memory of 3192 4980 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 83 PID 4980 wrote to memory of 4220 4980 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 86 PID 4980 wrote to memory of 4220 4980 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 86 PID 4980 wrote to memory of 4220 4980 1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe 86 PID 4220 wrote to memory of 3216 4220 cmd.exe 88 PID 4220 wrote to memory of 3216 4220 cmd.exe 88 PID 4220 wrote to memory of 3216 4220 cmd.exe 88 PID 3192 wrote to memory of 1028 3192 tfijdyc.exe 89 PID 3192 wrote to memory of 1028 3192 tfijdyc.exe 89 PID 3192 wrote to memory of 1028 3192 tfijdyc.exe 89 PID 3192 wrote to memory of 1028 3192 tfijdyc.exe 89 PID 1028 wrote to memory of 2360 1028 explorer.exe 16 PID 1028 wrote to memory of 2360 1028 explorer.exe 16 PID 1028 wrote to memory of 2360 1028 explorer.exe 16 PID 1028 wrote to memory of 2508 1028 explorer.exe 50 PID 1028 wrote to memory of 2508 1028 explorer.exe 50 PID 1028 wrote to memory of 2508 1028 explorer.exe 50 PID 1028 wrote to memory of 1996 1028 explorer.exe 43 PID 1028 wrote to memory of 1996 1028 explorer.exe 43 PID 1028 wrote to memory of 1996 1028 explorer.exe 43 PID 1028 wrote to memory of 3392 1028 explorer.exe 42 PID 1028 wrote to memory of 3392 1028 explorer.exe 42 PID 1028 wrote to memory of 3392 1028 explorer.exe 42 PID 1028 wrote to memory of 3492 1028 explorer.exe 41 PID 1028 wrote to memory of 3492 1028 explorer.exe 41 PID 1028 wrote to memory of 3492 1028 explorer.exe 41 PID 1028 wrote to memory of 3624 1028 explorer.exe 19 PID 1028 wrote to memory of 3624 1028 explorer.exe 19 PID 1028 wrote to memory of 3624 1028 explorer.exe 19 PID 1028 wrote to memory of 3724 1028 explorer.exe 39 PID 1028 wrote to memory of 3724 1028 explorer.exe 39 PID 1028 wrote to memory of 3724 1028 explorer.exe 39 PID 1028 wrote to memory of 3964 1028 explorer.exe 38 PID 1028 wrote to memory of 3964 1028 explorer.exe 38 PID 1028 wrote to memory of 3964 1028 explorer.exe 38 PID 1028 wrote to memory of 4856 1028 explorer.exe 36 PID 1028 wrote to memory of 4856 1028 explorer.exe 36 PID 1028 wrote to memory of 4856 1028 explorer.exe 36 PID 1028 wrote to memory of 5112 1028 explorer.exe 23 PID 1028 wrote to memory of 5112 1028 explorer.exe 23 PID 1028 wrote to memory of 5112 1028 explorer.exe 23 PID 1028 wrote to memory of 4220 1028 explorer.exe 86 PID 1028 wrote to memory of 4220 1028 explorer.exe 86 PID 1028 wrote to memory of 4220 1028 explorer.exe 86 PID 1028 wrote to memory of 4772 1028 explorer.exe 87 PID 1028 wrote to memory of 4772 1028 explorer.exe 87 PID 1028 wrote to memory of 4772 1028 explorer.exe 87 PID 1028 wrote to memory of 3216 1028 explorer.exe 88 PID 1028 wrote to memory of 3216 1028 explorer.exe 88 PID 1028 wrote to memory of 3216 1028 explorer.exe 88 PID 1028 wrote to memory of 2360 1028 explorer.exe 16 PID 1028 wrote to memory of 2360 1028 explorer.exe 16 PID 1028 wrote to memory of 2360 1028 explorer.exe 16 PID 1028 wrote to memory of 2508 1028 explorer.exe 50 PID 1028 wrote to memory of 2508 1028 explorer.exe 50 PID 1028 wrote to memory of 2508 1028 explorer.exe 50 PID 1028 wrote to memory of 1996 1028 explorer.exe 43 PID 1028 wrote to memory of 1996 1028 explorer.exe 43 PID 1028 wrote to memory of 1996 1028 explorer.exe 43 PID 1028 wrote to memory of 3392 1028 explorer.exe 42 PID 1028 wrote to memory of 3392 1028 explorer.exe 42 PID 1028 wrote to memory of 3392 1028 explorer.exe 42
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2360
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3624
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5112
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4856
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3964
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3724
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3492
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3392
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe"C:\Users\Admin\AppData\Local\Temp\1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe"2⤵
- Checks computer location settings
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Roaming\Microsoft\Tfijdycf\tfijdyc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Tfijdycf\tfijdyc.exe3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\\System32\\autoconv.exe" > "C:\Users\Admin\AppData\Local\Temp\1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4.exe" & del /F /Q "C:\Users\Admin\AppData\Local\Temp\1f7d74e5ccf5681021323717359f3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4772
-
-
C:\Windows\SysWOW64\PING.EXEping.exe -n 6 127.0.0.14⤵
- Runs ping.exe
PID:3216
-
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2508
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2624
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79B
MD59bdfc3d284e35bd0ff274fc34138560b
SHA1beff3a8e437f11ea10a3cc3fc42837454c7528a2
SHA25617f5998d92ef99c669f31b064cbaf992835c59eaa7b4f5f3cf7c828f54a53909
SHA5121aa6b4c51cb7e0d987de3839a20dbf599369841ea715f3b18cf06c471d50dcb0857211c4083d5af21e1f15ef043237efdeccc62050d71ff99f90af521c629837
-
Filesize
228KB
MD5f37f9160e2cf021983080ee0046529be
SHA165095a67c453db178b5735e7ecbeccbf1338ed75
SHA2561f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4
SHA512e02014e203c776bf8f11ebd48dc9abf132a8a907fa87e21b0f37306b0924f56dce99af7ed5fbcd862b3c6173c7cf09335c2fc1d4edc6f5753bd16bfdbab2d5de
-
Filesize
228KB
MD5f37f9160e2cf021983080ee0046529be
SHA165095a67c453db178b5735e7ecbeccbf1338ed75
SHA2561f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4
SHA512e02014e203c776bf8f11ebd48dc9abf132a8a907fa87e21b0f37306b0924f56dce99af7ed5fbcd862b3c6173c7cf09335c2fc1d4edc6f5753bd16bfdbab2d5de