Analysis
- max time kernel
303s - max time network
312s - platform
windows10-2004_x64 - resource
win10v2004-20220812-es - resource tags
arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows - submitted
14/11/2022, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
ReporteTPMNZGZSFQiszufTHFMK.exe
Resource
win7-20220812-es
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
ReporteTPMNZGZSFQiszufTHFMK.exe
Resource
win10v2004-20220812-es
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral3
Sample
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~77270.dll
Resource
win7-20220812-es
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~77270.dll
Resource
win10v2004-20220812-es
windows10-2004-x64
0 signatures
300 seconds
General
- Target ReporteTPMNZGZSFQiszufTHFMK.exe
- Size 322.4MB
- Sample221114-xp3ayada77
- SHA256 6c25a2afdb549fc98f52fd1b091d5ff28bdc609dcbe9fb41e0603ee02869d659
- MD5 743feb63ff45e8d2718f93c0bba53462
- SHA1 0ecdab9c49d76a1cb0399f957b29ba53ee16b9e0
- SHA512 0d2bb03b1320767417687c0cb6fe1ce9810f965b4793816b14e3a69354de4364081cb0dfc517f6bd384469267ba4cb7e504556e41492c7355e8bd7191141d5ce
- SSDEEP 49152:TWjez9bl8O7pSTQVoofmn5zMvbg+/adL1OeJTeoHz9wa+T/oUrB8GNEXmT1iXfUF:TWExgKfm9M8+/ad5wja+T5H+lv/eH
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 364 DriversUpdattVMcAGHQNSF.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ReporteTPMNZGZSFQiszufTHFMK.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run DriversUpdattVMcAGHQNSF.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CratingAudioDeviceA385AF5 = "C:\\ProgramData\\DriversUpdatjKvDmNq\\DriversUpdattVMcAGHQNSF.exe" DriversUpdattVMcAGHQNSF.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CratingAudioDevice18V39G5 = "cmd.exe /c start C:\\ProgramData\\DriversUpdatjKvDmNq\\DriversUpdattVMcAGHQNSF.exe" DriversUpdattVMcAGHQNSF.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 38 ipinfo.io - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 4776 ReporteTPMNZGZSFQiszufTHFMK.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe Token: SeIncBasePriorityPrivilege 364 DriversUpdattVMcAGHQNSF.exe Token: 33 364 DriversUpdattVMcAGHQNSF.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4776 ReporteTPMNZGZSFQiszufTHFMK.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4776 wrote to memory of 364 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 84 PID 4776 wrote to memory of 364 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 84 PID 4776 wrote to memory of 364 4776 ReporteTPMNZGZSFQiszufTHFMK.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\ReporteTPMNZGZSFQiszufTHFMK.exe"C:\Users\Admin\AppData\Local\Temp\ReporteTPMNZGZSFQiszufTHFMK.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\ProgramData\DriversUpdatjKvDmNq\DriversUpdattVMcAGHQNSF.exe"C:\ProgramData\DriversUpdatjKvDmNq\DriversUpdattVMcAGHQNSF.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:364
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\DriversUpdatjKvDmNq\DriversUpdattVMcAGHQNSF.exe
- Size 620.2MB
- SHA256 31ecacd98974afe87e403afc120cb23684801524219f06d5b14cd161b54dca65
- MD5 253e98f1d6f191776e0cfba483de79b3
- SHA1 b4cc449779726f1c6afb7ccae53e967feb667cb7
- SHA512 2a68b2307b61272423a546e79f0374b86d4f23ca07a58769465e39f28bf582db8339268cd59b4844f4e9b25e37b312832e5c1c6d24f5c67576f2ad9245356ccc
- SSDEEP 196608:FiIvqO0TgdofBHwcxV9ptGqUmUu8q9yxekW2VYHm6:FpvqO0TLpHwcVpwqFV8qKpWeMZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\DriversUpdatjKvDmNq\DriversUpdattVMcAGHQNSF.exe
- Size 620.2MB
- SHA256 31ecacd98974afe87e403afc120cb23684801524219f06d5b14cd161b54dca65
- MD5 253e98f1d6f191776e0cfba483de79b3
- SHA1 b4cc449779726f1c6afb7ccae53e967feb667cb7
- SHA512 2a68b2307b61272423a546e79f0374b86d4f23ca07a58769465e39f28bf582db8339268cd59b4844f4e9b25e37b312832e5c1c6d24f5c67576f2ad9245356ccc
- SSDEEP 196608:FiIvqO0TgdofBHwcxV9ptGqUmUu8q9yxekW2VYHm6:FpvqO0TLpHwcVpwqFV8qKpWeMZ
- MD5 SHA1 SHA512 SSDEEP