3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5

Analysis

max time kernel
136s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe
Size

228KB
MD5

d3577c4e72d6b51813f2b1caa33ee41e
SHA1

488d3129732aed8ddff2642c3c087e3a4938d836
SHA256

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5
SHA512

0dbe841c3b830a0e82f278bae04fd4ea71b6e9a49588514d1bde0c4e5b17e83d36250f01a7138fe0f49632943aa5de1ada229fc2c1cc609b69bbe1c5acbd9ee1
SSDEEP

3072:zKPIMPYbAlsrJ7KL0NerZBqe3i7zdKUXXYMdVZS6rrtOh63MFOydj:zMYbAlMFOs7zdjldVZSMWdFO

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

SystemControlS.exe

pid process

2580 SystemControlS.exe

pid	process
2580	SystemControlS.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exeSystemControlS.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Autumn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe"	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Autumn = "C:\\Users\\Admin\\AppData\\Roaming\\Founder Systems\\SystemControlS.exe"	SystemControlS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

pid process

4216 3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

description pid process

Token: SeDebugPrivilege 4216 3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

pid	process
4216	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

description	pid	process
Token: SeDebugPrivilege	4216	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe

description	pid	process	target process
PID 4216 wrote to memory of 2580	4216	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe	SystemControlS.exe
PID 4216 wrote to memory of 2580	4216	3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe	SystemControlS.exe

C:\Users\Admin\AppData\Local\Temp\3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe
"C:\Users\Admin\AppData\Local\Temp\3a2e77d14c75f3006d093a2c64952b6ebd05303175c9e1d46b28378b26e9e8b5.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216

C:\Users\Admin\AppData\Roaming\Founder Systems\SystemControlS.exe
"C:\Users\Admin\AppData\Roaming\Founder Systems\SystemControlS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Founder Systems\SystemControlS.exe

Filesize
221KB

MD5
003582bac5429ce527bb975fecf32779

SHA1
f3f593e58154e68bc5c3acf1b157c309d357f541

SHA256
8409fb981e144fedf99a6955d9e28a5feeb9094b4b8fae5914ef2ed862ec9c46

SHA512
a29cff19d4408614897f6164db9e84bc1c630e9f29c7b0e1663e4560ab9080db3b3d475ad7d6f4d3661a98b50be1a39b3090bda6f6ba4e459547bbdc54644ad3

Download Submit
C:\Users\Admin\AppData\Roaming\Founder Systems\SystemControlS.exe

Filesize
221KB

MD5
003582bac5429ce527bb975fecf32779

SHA1
f3f593e58154e68bc5c3acf1b157c309d357f541

SHA256
8409fb981e144fedf99a6955d9e28a5feeb9094b4b8fae5914ef2ed862ec9c46

SHA512
a29cff19d4408614897f6164db9e84bc1c630e9f29c7b0e1663e4560ab9080db3b3d475ad7d6f4d3661a98b50be1a39b3090bda6f6ba4e459547bbdc54644ad3

Download Submit
memory/2580-133-0x0000000000000000-mapping.dmp

Download
memory/2580-137-0x00007FFE52120000-0x00007FFE52B56000-memory.dmp

Filesize
10.2MB

Download
memory/4216-132-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download
memory/4216-136-0x00000000750A0000-0x0000000075651000-memory.dmp

Filesize
5.7MB

Download