Analysis
-
max time kernel
61s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe
-
Size
86KB
-
MD5
03e3bea4774d5715ab7be5997a15ed90
-
SHA1
2dbb06ccf3c21a5a295eb06c5ba387dc1100990b
-
SHA256
24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe
-
SHA512
53ffc6d1dea48babd66d5779a87914832745f16b4b0ad002891f64088bb89f0842a0e29d39a3a60a22860e03670c22c3cd1dcd102894206f9334e0ace4f54e87
-
SSDEEP
1536:i/E/8FZmgTJtnSe+L6ZtTqI1Rfkq4JoDpY7CciCEvadVj/:ickDmgTXSBCt71RfkqooDST7
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\Z: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\N: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\S: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\I: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\L: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\T: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\U: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\X: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\Y: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\E: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\F: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\P: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\A: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\G: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\J: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\K: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\M: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\O: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\Q: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\R: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\B: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\H: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe File opened (read-only) \??\W: 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe -
Suspicious behavior: MapViewOfSection 22 IoCs
pid Process 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe Token: SeShutdownPrivilege 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1852 wrote to memory of 368 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 25 PID 1852 wrote to memory of 368 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 25 PID 1852 wrote to memory of 368 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 25 PID 1852 wrote to memory of 368 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 25 PID 1852 wrote to memory of 368 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 25 PID 1852 wrote to memory of 368 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 25 PID 1852 wrote to memory of 368 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 25 PID 1852 wrote to memory of 376 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 24 PID 1852 wrote to memory of 376 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 24 PID 1852 wrote to memory of 376 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 24 PID 1852 wrote to memory of 376 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 24 PID 1852 wrote to memory of 376 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 24 PID 1852 wrote to memory of 376 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 24 PID 1852 wrote to memory of 376 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 24 PID 1852 wrote to memory of 416 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 23 PID 1852 wrote to memory of 416 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 23 PID 1852 wrote to memory of 416 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 23 PID 1852 wrote to memory of 416 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 23 PID 1852 wrote to memory of 416 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 23 PID 1852 wrote to memory of 416 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 23 PID 1852 wrote to memory of 416 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 23 PID 1852 wrote to memory of 460 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 22 PID 1852 wrote to memory of 460 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 22 PID 1852 wrote to memory of 460 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 22 PID 1852 wrote to memory of 460 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 22 PID 1852 wrote to memory of 460 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 22 PID 1852 wrote to memory of 460 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 22 PID 1852 wrote to memory of 460 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 22 PID 1852 wrote to memory of 476 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1 PID 1852 wrote to memory of 476 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1 PID 1852 wrote to memory of 476 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1 PID 1852 wrote to memory of 476 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1 PID 1852 wrote to memory of 476 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1 PID 1852 wrote to memory of 476 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1 PID 1852 wrote to memory of 476 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 1 PID 1852 wrote to memory of 484 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 21 PID 1852 wrote to memory of 484 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 21 PID 1852 wrote to memory of 484 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 21 PID 1852 wrote to memory of 484 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 21 PID 1852 wrote to memory of 484 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 21 PID 1852 wrote to memory of 484 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 21 PID 1852 wrote to memory of 484 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 21 PID 1852 wrote to memory of 576 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 20 PID 1852 wrote to memory of 576 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 20 PID 1852 wrote to memory of 576 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 20 PID 1852 wrote to memory of 576 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 20 PID 1852 wrote to memory of 576 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 20 PID 1852 wrote to memory of 576 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 20 PID 1852 wrote to memory of 576 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 20 PID 1852 wrote to memory of 652 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 19 PID 1852 wrote to memory of 652 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 19 PID 1852 wrote to memory of 652 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 19 PID 1852 wrote to memory of 652 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 19 PID 1852 wrote to memory of 652 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 19 PID 1852 wrote to memory of 652 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 19 PID 1852 wrote to memory of 652 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 19 PID 1852 wrote to memory of 740 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 18 PID 1852 wrote to memory of 740 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 18 PID 1852 wrote to memory of 740 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 18 PID 1852 wrote to memory of 740 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 18 PID 1852 wrote to memory of 740 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 18 PID 1852 wrote to memory of 740 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 18 PID 1852 wrote to memory of 740 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 18 PID 1852 wrote to memory of 792 1852 24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe 17
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:1956
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:2028
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵PID:1800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵PID:1656
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe"C:\Users\Admin\AppData\Local\Temp\24f035a79da88fabb5255846270680362af6e542f1e8722433794f87e0024cfe.exe"2⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵PID:1060
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵PID:240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:832
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵PID:792
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵PID:652
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:576
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:484
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:460
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:376
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368