Analysis
-
max time kernel
161s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 08:06
Static task
static1
Behavioral task
behavioral1
Sample
92cc325d156ad9b91a7a3fd68fd6bef31b384b535332563a019892e79a8b21f2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
92cc325d156ad9b91a7a3fd68fd6bef31b384b535332563a019892e79a8b21f2.exe
Resource
win10v2004-20220812-en
General
-
Target
92cc325d156ad9b91a7a3fd68fd6bef31b384b535332563a019892e79a8b21f2.exe
-
Size
776KB
-
MD5
303775ab33384470f8ab553d87af8340
-
SHA1
e026b61e243844d3329b552e4f46ab366b2291e7
-
SHA256
92cc325d156ad9b91a7a3fd68fd6bef31b384b535332563a019892e79a8b21f2
-
SHA512
d601967bb12f1a08ec98725c2e64531f7f97b4cf41a99a1d1ef13ca849ca46b23c6c12066326ce69c44d52df0b6bd5be36d1ae01bdd108bb81d481c78c65b891
-
SSDEEP
12288:7AAMW0OfelD3DPDJnm5h9s99VOKGIBr+lLzQbVi6b15u5D2zvC69JXvBGv4:7zAmD9+qqBr+lLzQjx5uE4v4
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2104 Software.exe 2844 Software.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 92cc325d156ad9b91a7a3fd68fd6bef31b384b535332563a019892e79a8b21f2.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2104 set thread context of 2844 2104 Software.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4520 2844 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2104 Software.exe 2104 Software.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2104 Software.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4908 wrote to memory of 2104 4908 92cc325d156ad9b91a7a3fd68fd6bef31b384b535332563a019892e79a8b21f2.exe 81 PID 4908 wrote to memory of 2104 4908 92cc325d156ad9b91a7a3fd68fd6bef31b384b535332563a019892e79a8b21f2.exe 81 PID 4908 wrote to memory of 2104 4908 92cc325d156ad9b91a7a3fd68fd6bef31b384b535332563a019892e79a8b21f2.exe 81 PID 2104 wrote to memory of 2844 2104 Software.exe 84 PID 2104 wrote to memory of 2844 2104 Software.exe 84 PID 2104 wrote to memory of 2844 2104 Software.exe 84 PID 2104 wrote to memory of 2844 2104 Software.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\92cc325d156ad9b91a7a3fd68fd6bef31b384b535332563a019892e79a8b21f2.exe"C:\Users\Admin\AppData\Local\Temp\92cc325d156ad9b91a7a3fd68fd6bef31b384b535332563a019892e79a8b21f2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\Software.exe"C:\Users\Admin\AppData\Local\Temp\Software.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\Software.exeC:\Users\Admin\AppData\Local\Temp\Software.exe3⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 804⤵
- Program crash
PID:4520
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2844 -ip 28441⤵PID:2072
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
599KB
MD5c182ffc03983fc4c0ab59453bac3aecc
SHA12ff9e406a79b4d7b9e25ba609128f5afa6d4d2b4
SHA256d2e1f72a616d8ad637956c56f4658fb0d9024829f20e3a6417f5a99e3e2f5ed6
SHA51267bb636fe169ada92c8d78f8a7d7ce61eceb20a7847dc4fd4ab2f39c1f27edb3745afe49191cff6e8dcdeedd5d3d2f34cad8837dfb2b08328d6a920af8c86df9
-
Filesize
599KB
MD5c182ffc03983fc4c0ab59453bac3aecc
SHA12ff9e406a79b4d7b9e25ba609128f5afa6d4d2b4
SHA256d2e1f72a616d8ad637956c56f4658fb0d9024829f20e3a6417f5a99e3e2f5ed6
SHA51267bb636fe169ada92c8d78f8a7d7ce61eceb20a7847dc4fd4ab2f39c1f27edb3745afe49191cff6e8dcdeedd5d3d2f34cad8837dfb2b08328d6a920af8c86df9
-
Filesize
599KB
MD5c182ffc03983fc4c0ab59453bac3aecc
SHA12ff9e406a79b4d7b9e25ba609128f5afa6d4d2b4
SHA256d2e1f72a616d8ad637956c56f4658fb0d9024829f20e3a6417f5a99e3e2f5ed6
SHA51267bb636fe169ada92c8d78f8a7d7ce61eceb20a7847dc4fd4ab2f39c1f27edb3745afe49191cff6e8dcdeedd5d3d2f34cad8837dfb2b08328d6a920af8c86df9