Overview

overview

8

Static

static

3cac652582...10.exe

windows7-x64

8

3cac652582...10.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    130s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 18:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    3cac652582218a44c7b7ae363c4f5a66108f873c538118de3011ff38872e0b10.exe

  • Size

    1001KB

  • MD5

    82d387b0add758efe29a7883e2eedf40

  • SHA1

    d1bb88579eb75dae7456077d1a59dd576ce69699

  • SHA256

    3cac652582218a44c7b7ae363c4f5a66108f873c538118de3011ff38872e0b10

  • SHA512

    328b88d777786bcbbd6be1eb561cc30c93f94fc9c5ba59a6a3434dda4cd9a97841192be161f8da0bcf7843188d5631cd41272a3336baccb3400353dca9beb690

  • SSDEEP

    12288:HJdZEut4RuAwGgc7fNuIEGpXL6+sNza1Q2OoJpaz/g/J/vSnn:pvEuAwj2fNuIr6+sN6Q21az/g/J/Gn

Score
8/10
evasion

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Stops running service(s) 3 TTPs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cac652582218a44c7b7ae363c4f5a66108f873c538118de3011ff38872e0b10.exe
    "C:\Users\Admin\AppData\Local\Temp\3cac652582218a44c7b7ae363c4f5a66108f873c538118de3011ff38872e0b10.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" import C:\Windows\5717.mp4
      2⤵
        PID:5012
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" config PolicyAgent start= auto
        2⤵
        • Launches sc.exe
        PID:2480
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" stop PolicyAgent
        2⤵
        • Launches sc.exe
        PID:3588
      • C:\Windows\SysWOW64\sc.exe
        "C:\Windows\System32\sc.exe" start PolicyAgent
        2⤵
        • Launches sc.exe
        PID:4936
      • C:\Users\Admin\AppData\Local\Temp\cc240582500.exe
        "C:\Users\Admin\AppData\Local\Temp\cc240582500.exe"
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3496
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 1404
        2⤵
        • Program crash
        PID:1504
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2020
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2604 -ip 2604
      1⤵
        PID:216

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\cc240582500.exe
              Filesize

              16KB

              MD5

              5688720a46b3ab38c0b6833643584f1a

              SHA1

              107fab1b84929016d3047be4b0e1af729633bf25

              SHA256

              5781993f7a04c4da50a6b493eaf6e4bb1823c01bfc26d2507ecfcded5a02e32c

              SHA512

              bbe96525dd663a0eac8e78810107e3a6d6b2cc996efc3a0424b63f338366f6e7cbd7e2e748caf15d0929f1ea630ef3df18b6cf2d171f219b2df9c193f8e55dcf

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\cc240582500.exe
              Filesize

              16KB

              MD5

              5688720a46b3ab38c0b6833643584f1a

              SHA1

              107fab1b84929016d3047be4b0e1af729633bf25

              SHA256

              5781993f7a04c4da50a6b493eaf6e4bb1823c01bfc26d2507ecfcded5a02e32c

              SHA512

              bbe96525dd663a0eac8e78810107e3a6d6b2cc996efc3a0424b63f338366f6e7cbd7e2e748caf15d0929f1ea630ef3df18b6cf2d171f219b2df9c193f8e55dcf

              Download Submit

            • C:\Windows\5717.mp4
              Filesize

              56KB

              MD5

              c79a9afdfd1c724b870d6af639335838

              SHA1

              534d4aea783dcbca5949e51ab2dff3db618851d7

              SHA256

              ab78e4c333f423f9fd321ba90d7b8c197ba793bfc9159c6aae73c22788e1d188

              SHA512

              788edf24f6204ed4a75b6ea672f607c47dc7fcf88312929eb644fbc707a0c9573c25c793f02fd9827605b19b01776ff072f36833df6d96861ff54c6f51a9fc96

              Download Submit

            • C:\Windows\SysWOW64\jsseting.data
              Filesize

              16KB

              MD5

              add4832059173fcdb135d949194ad52b

              SHA1

              33f1dfd83e76e0897bd134d380fd56431a7cde6b

              SHA256

              2f9b075862a8509928a48c20bd988215c4f754d2ee3171cf15320ffe6f77f957

              SHA512

              ac04e7ec33592423a85dbcd0aa7a40e5e63671ad712101f007db8551be49b407c508e17d80fd3dcdece2a9d0a8cf9980aae5aa76e8452af73485fd62f31ad0d5

              Download Submit

            • C:\Windows\SysWOW64\jsseting.data
              Filesize

              16KB

              MD5

              add4832059173fcdb135d949194ad52b

              SHA1

              33f1dfd83e76e0897bd134d380fd56431a7cde6b

              SHA256

              2f9b075862a8509928a48c20bd988215c4f754d2ee3171cf15320ffe6f77f957

              SHA512

              ac04e7ec33592423a85dbcd0aa7a40e5e63671ad712101f007db8551be49b407c508e17d80fd3dcdece2a9d0a8cf9980aae5aa76e8452af73485fd62f31ad0d5

              Download Submit

            • memory/2604-138-0x0000000000400000-0x0000000000431E7D-memory.dmp

              Filesize

              199KB

              Download

            • memory/2604-132-0x0000000000400000-0x0000000000431E7D-memory.dmp

              Filesize

              199KB

              Download

            • memory/2604-133-0x0000000000400000-0x0000000000431E7D-memory.dmp

              Filesize

              199KB

              Download

            • memory/2604-145-0x0000000003090000-0x0000000003096000-memory.dmp

              Filesize

              24KB

              Download

            • memory/2604-146-0x0000000003090000-0x0000000003096000-memory.dmp

              Filesize

              24KB

              Download

            • memory/2604-147-0x0000000000400000-0x0000000000431E7D-memory.dmp

              Filesize

              199KB

              Download