Analysis
-
max time kernel
90s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2022 17:51
Static task
static1
Behavioral task
behavioral1
Sample
1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe
-
Size
92KB
-
MD5
8320554ebfa8c9ba269b68af2e827e87
-
SHA1
643fae6cbdf78628224dc541413fe49ea7ca7369
-
SHA256
1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82
-
SHA512
bdff9447d4725deca2b5800b5ff7c02a045772891d5db2beff6ebf6e408d49a7a7bca4cae252dd14ec44c7081c7ab8c131549cc4fefd4c55e04eeb231864df66
-
SSDEEP
768:K99XHugT0lvlq/P1vwwrnkjBt1ZJk8vK8GSdrD9wGy241ZUb/CxhYLJP30UOEGaK:+5PuB7mUbaxeLd4IfmkBwC8BD+KBq2x
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2204 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2204 tasklist.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 384 wrote to memory of 5036 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 81 PID 384 wrote to memory of 5036 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 81 PID 384 wrote to memory of 5036 384 1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe 81 PID 5036 wrote to memory of 2204 5036 cmd.exe 83 PID 5036 wrote to memory of 2204 5036 cmd.exe 83 PID 5036 wrote to memory of 2204 5036 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe"C:\Users\Admin\AppData\Local\Temp\1f6a5c1a362037418ea29817b2b004fedd453126422c2d19c8a2ba19bf7a1c82.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 1f6a5c1a362037418ea29817b2b004fedd2⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-