Analysis
-
max time kernel
257s -
max time network
272s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2022 15:06
Static task
static1
Behavioral task
behavioral1
Sample
9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exe
Resource
win10v2004-20221111-en
General
-
Target
9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exe
-
Size
383KB
-
MD5
249afc0c47910087eb313fb999b7bc4c
-
SHA1
7389d6eeb571bfa4731a06deb9535996d2c1828f
-
SHA256
9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073
-
SHA512
af8581f9ecb2fd7475b86c02159cb16c79973e12bd914cefb885400bc3ea6fb01749aabe3d89d66c084c60db2310afec9bda0c3ea3ad2906800f1e8c6e6d712e
-
SSDEEP
6144:+iWKESG24OQjFnM6X4nLlHxmbxS5t8EovmIi+IJmk9nSTtT6V12RBq1DooGHp38V:6SG1InLlakHoOIizLdgswRBq1iJ8
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
16.exeexplorer.exepid process 4340 16.exe 3776 explorer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\explorer\explorer.exe vmprotect C:\Users\Admin\AppData\Roaming\explorer\explorer.exe vmprotect behavioral2/memory/3776-140-0x00007FF623450000-0x00007FF623CE5000-memory.dmp vmprotect behavioral2/memory/3776-141-0x00007FF623450000-0x00007FF623CE5000-memory.dmp vmprotect behavioral2/memory/3776-142-0x00007FF623450000-0x00007FF623CE5000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation 9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
16.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run 16.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer\\explorer.exe" 16.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
explorer.exepid process 3776 explorer.exe 3776 explorer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exedescription pid process Token: SeDebugPrivilege 4748 9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exe16.execmd.exedescription pid process target process PID 4748 wrote to memory of 4340 4748 9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exe 16.exe PID 4748 wrote to memory of 4340 4748 9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exe 16.exe PID 4748 wrote to memory of 4340 4748 9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exe 16.exe PID 4340 wrote to memory of 4688 4340 16.exe cmd.exe PID 4340 wrote to memory of 4688 4340 16.exe cmd.exe PID 4340 wrote to memory of 4688 4340 16.exe cmd.exe PID 4688 wrote to memory of 3776 4688 cmd.exe explorer.exe PID 4688 wrote to memory of 3776 4688 cmd.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exe"C:\Users\Admin\AppData\Local\Temp\9480e8b5b5d3b10d6d8ce91c81a260057d8c22740960960a05cc338b3c8e3073.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\16.exe"C:\Windows\Temp\16.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\explorer\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explorer\explorer.exeC:\Users\Admin\AppData\Roaming\explorer\explorer.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\explorer\explorer.exeFilesize
5.2MB
MD5dee1568dc4d523e4aff5c7563b26887c
SHA1565a8f3d02746fb203c5a7e2777211bf33cf656b
SHA256f7cbf79fce9ca7d06745604a44c6b2541af476cdd8f5853bf1dbf23213eb3d2b
SHA5120e593e23f5cfbf3bf0cc07373bb013911e9c2068cfad8e666c69173afbe29d06a0635dc32dfa6baca153db2e1de25772cccbc5f63d49d19bc4d18b93f7c97ab2
-
C:\Users\Admin\AppData\Roaming\explorer\explorer.exeFilesize
5.2MB
MD5dee1568dc4d523e4aff5c7563b26887c
SHA1565a8f3d02746fb203c5a7e2777211bf33cf656b
SHA256f7cbf79fce9ca7d06745604a44c6b2541af476cdd8f5853bf1dbf23213eb3d2b
SHA5120e593e23f5cfbf3bf0cc07373bb013911e9c2068cfad8e666c69173afbe29d06a0635dc32dfa6baca153db2e1de25772cccbc5f63d49d19bc4d18b93f7c97ab2
-
C:\Windows\Temp\16.exeFilesize
111KB
MD5d5e60efb9108de74544c623538278585
SHA1fc03eda03ca0510dfb26cf5ea1b3d4e6ff7567b7
SHA256353e1bf0f0f4deb4203328160856d4e967a1fe36b4a5d126d799c1b7dee027c0
SHA512769c9ec6808af451eb58a1a2d767f8f10fec5d7abe616737ae6d81b107546e0bbfcbef7cf2f2bc9bcebfcf96bdfc4b55b4c3a506beb3f094093d9c6682ffa4ca
-
C:\Windows\Temp\16.exeFilesize
111KB
MD5d5e60efb9108de74544c623538278585
SHA1fc03eda03ca0510dfb26cf5ea1b3d4e6ff7567b7
SHA256353e1bf0f0f4deb4203328160856d4e967a1fe36b4a5d126d799c1b7dee027c0
SHA512769c9ec6808af451eb58a1a2d767f8f10fec5d7abe616737ae6d81b107546e0bbfcbef7cf2f2bc9bcebfcf96bdfc4b55b4c3a506beb3f094093d9c6682ffa4ca
-
memory/3776-137-0x0000000000000000-mapping.dmp
-
memory/3776-140-0x00007FF623450000-0x00007FF623CE5000-memory.dmpFilesize
8.6MB
-
memory/3776-141-0x00007FF623450000-0x00007FF623CE5000-memory.dmpFilesize
8.6MB
-
memory/3776-142-0x00007FF623450000-0x00007FF623CE5000-memory.dmpFilesize
8.6MB
-
memory/4340-133-0x0000000000000000-mapping.dmp
-
memory/4688-136-0x0000000000000000-mapping.dmp
-
memory/4748-132-0x0000000000A60000-0x0000000000AC6000-memory.dmpFilesize
408KB