Analysis
-
max time kernel
164s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:02
Static task
static1
Behavioral task
behavioral1
Sample
fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe
-
Size
1.1MB
-
MD5
55aaf5931e1f74b704044b846d2ffcdf
-
SHA1
1bf392fb69e3d76e4a105c8efe4ec2c9cab96e63
-
SHA256
fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a
-
SHA512
4ca8c392cb2c6db962df8cebb67cfaf9c0ee0f81e43dd9be058ff7cc2c851c4c9f4de8c264617293d32885b986e5dab3c030296237ea9ecd6f57c0702373bee8
-
SSDEEP
24576:t2O/Gl+L9i4SWzsCx592IRNHfOUED4RVPVI8Qyqd7FbO:sqn0IfHfOUEDAILyYhO
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1984 winUpdate.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce winUpdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\m2v4v7zg9ix7 = "\\Users\\Admin\\m2v4v7zg9ix7\\lextapzxx.vbs" winUpdate.exe Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN winUpdate.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN winUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winUpdate.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winUpdate.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini RegSvcs.exe File created C:\Windows\assembly\Desktop.ini RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1984 set thread context of 2144 1984 winUpdate.exe 82 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly RegSvcs.exe File created C:\Windows\assembly\Desktop.ini RegSvcs.exe File opened for modification C:\Windows\assembly\Desktop.ini RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe 1984 winUpdate.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2144 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 2144 RegSvcs.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe Token: SeDebugPrivilege 1984 winUpdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2144 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1260 wrote to memory of 1984 1260 fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe 80 PID 1260 wrote to memory of 1984 1260 fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe 80 PID 1260 wrote to memory of 1984 1260 fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe 80 PID 1984 wrote to memory of 2144 1984 winUpdate.exe 82 PID 1984 wrote to memory of 2144 1984 winUpdate.exe 82 PID 1984 wrote to memory of 2144 1984 winUpdate.exe 82 PID 1984 wrote to memory of 2144 1984 winUpdate.exe 82 PID 1984 wrote to memory of 2144 1984 winUpdate.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe"C:\Users\Admin\AppData\Local\Temp\fa7eaa5c59411ad4c06f0f98ebbc7c444d8133fcfe98f7200c62e9686594387a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\m2v4v7zg9ix7\winUpdate.exe"C:\Users\Admin\m2v4v7zg9ix7\winUpdate.exe" kvokks.MCA2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2144
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
277KB
MD54d830bb6881a011a725275f75499645c
SHA153f14a69f53dcda8425405123425f34930753218
SHA256e06fe878c778112e6784fea4b309f7b44fe027e1a89d030975bf565fea815bfe
SHA512cd52904a56651d9f9a292b7161adf28520869bd42d907b44535cab2399c7091ed0dfa3a1f757d83a8b21f082dc6f794b59f8e765de5879965352e7bc70375fc6
-
Filesize
229B
MD54b94795c0152d55af432c777d1e21d0e
SHA164fd547f958cba6fea747cc8a476bd194ff10845
SHA25616d5e9af35da06436f114d21f14e53beb93c6a57e0ae6fabc603edd27f355eba
SHA5126d9bed98380f2a377e9dc889da85c714f4f5f9ba029d551f340bd53c229547573a49e215d43d7143ccf0b74dd08b05c7b7c7b4e1329844b5687f1461c817e4d1
-
Filesize
324.1MB
MD51528a7a002c969e55798a08329130ba2
SHA1054e90574a38cfdf61097decb332ee741fcddd2a
SHA256409699856af740ef8e251d8a72080a19eb2d9589975a5a6c5a8b503010f2d190
SHA5122128551e1f1ec79a9cd2d821d73b3b7a20460f6c7a598f232eab75357ddb7b1e8dadd2cadb92bd82a26da2867b3db6c789138df85ff590e92aa4cf8e44db0d9c
-
Filesize
912KB
MD56a93a4071cc7c22628af40a4d872f49b
SHA1ba916e686aa0cae19ab907bdab94924ada92b5f4
SHA2568465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01
SHA5125a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd
-
Filesize
912KB
MD56a93a4071cc7c22628af40a4d872f49b
SHA1ba916e686aa0cae19ab907bdab94924ada92b5f4
SHA2568465f3fcbccce3ea12495edbb0bd09c3b066e3df891613ce3180f9bb38b37b01
SHA5125a26af395a03397aadab13a53cac320f1d8bbe77046a61ae12e1f72f93df7afb360f52ef52f979f7b946a814365a298c3a3a536add6cdd7165896fb82abc4afd