cffc73850abfc4ca8cd6bc11ef77d8d91926046ee77e444de2c387061260f44b

Analysis

max time kernel
92s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.4MB
MD5

fb21c01c3d8d6b321034d48518c3d2a0
SHA1

372e822ce100a56d5066fce4574b9b0833daf27c
SHA256

cffc73850abfc4ca8cd6bc11ef77d8d91926046ee77e444de2c387061260f44b
SHA512

81902613230b6ebfdb4bedc7e352aa73b0d011a4bd5fe5734a6486bfc2a25393230b9a7e3136717d61d552d8873acc775c4d9a96d5bd0e8c15ac10179dce0edf
SSDEEP

24576:MiCj1Tnwpevq7BZlrkY/wP91wSRXZZAvnn3h:MR1Twpevq7HJkY4nwSRXIPn

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

OWT.exe

pid process

1160 OWT.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

OWT.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation OWT.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4896 1160 WerFault.exe OWT.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1856 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2132 timeout.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

3456 powershell.exe
3456 powershell.exe
4308 powershell.exe
4308 powershell.exe

pid	process
1160	OWT.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	OWT.exe

pid	pid_target	process	target process
4896	1160	WerFault.exe	OWT.exe

pid	process
1856	schtasks.exe

pid	process
2132	timeout.exe

pid	process
3456	powershell.exe
3456	powershell.exe
4308	powershell.exe
4308	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

file.exepowershell.exeOWT.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4344	file.exe
Token: SeDebugPrivilege	3456	powershell.exe
Token: SeDebugPrivilege	1160	OWT.exe
Token: SeDebugPrivilege	4308	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

file.execmd.exeOWT.execmd.exe

description	pid	process	target process
PID 4344 wrote to memory of 3456	4344	file.exe	powershell.exe
PID 4344 wrote to memory of 3456	4344	file.exe	powershell.exe
PID 4344 wrote to memory of 3800	4344	file.exe	cmd.exe
PID 4344 wrote to memory of 3800	4344	file.exe	cmd.exe
PID 3800 wrote to memory of 2132	3800	cmd.exe	timeout.exe
PID 3800 wrote to memory of 2132	3800	cmd.exe	timeout.exe
PID 3800 wrote to memory of 1160	3800	cmd.exe	OWT.exe
PID 3800 wrote to memory of 1160	3800	cmd.exe	OWT.exe
PID 1160 wrote to memory of 4308	1160	OWT.exe	powershell.exe
PID 1160 wrote to memory of 4308	1160	OWT.exe	powershell.exe
PID 1160 wrote to memory of 3176	1160	OWT.exe	cmd.exe
PID 1160 wrote to memory of 3176	1160	OWT.exe	cmd.exe
PID 3176 wrote to memory of 1856	3176	cmd.exe	schtasks.exe
PID 3176 wrote to memory of 1856	3176	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBF5D.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:3800

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2132

C:\ProgramData\winrar\OWT.exe
"C:\ProgramData\winrar\OWT.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
5⤵
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1160 -s 2152
4⤵
- Program crash
PID:4896

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 440 -p 1160 -ip 1160
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\winrar\OWT.exe

Filesize
1.4MB

MD5
fb21c01c3d8d6b321034d48518c3d2a0

SHA1
372e822ce100a56d5066fce4574b9b0833daf27c

SHA256
cffc73850abfc4ca8cd6bc11ef77d8d91926046ee77e444de2c387061260f44b

SHA512
81902613230b6ebfdb4bedc7e352aa73b0d011a4bd5fe5734a6486bfc2a25393230b9a7e3136717d61d552d8873acc775c4d9a96d5bd0e8c15ac10179dce0edf

Download Submit
C:\ProgramData\winrar\OWT.exe

Filesize
1.4MB

MD5
fb21c01c3d8d6b321034d48518c3d2a0

SHA1
372e822ce100a56d5066fce4574b9b0833daf27c

SHA256
cffc73850abfc4ca8cd6bc11ef77d8d91926046ee77e444de2c387061260f44b

SHA512
81902613230b6ebfdb4bedc7e352aa73b0d011a4bd5fe5734a6486bfc2a25393230b9a7e3136717d61d552d8873acc775c4d9a96d5bd0e8c15ac10179dce0edf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBF5D.tmp.bat

Filesize
138B

MD5
2c4fb39eca9b574749e75e96b55cfd95

SHA1
b7ad5e52e2fa4ad2caa06d0cac9d163b68f5caf4

SHA256
d6a72bae9adcade606148974bdef78e0742788cbd01903ac3d3441a758344686

SHA512
3cdb153dc34361c43c0688454fda253691bcaac45ef9ec76bafdea0434a0eb9c4f24447ce0b274cafa943a67875fefa454c3579ec9cdece6be2a9a5946cac1d3

Download Submit
memory/1160-170-0x00007FFAA2E00000-0x00007FFAA38C1000-memory.dmp

Filesize
10.8MB

Download
memory/1160-166-0x0000000000180000-0x0000000000348000-memory.dmp

Filesize
1.8MB

Download
memory/1160-184-0x00007FFAA2E00000-0x00007FFAA38C1000-memory.dmp

Filesize
10.8MB

Download
memory/1160-162-0x00007FFAA3E00000-0x00007FFAA3EBD000-memory.dmp

Filesize
756KB

Download
memory/1160-182-0x00007FFAA4990000-0x00007FFAA4AFA000-memory.dmp

Filesize
1.4MB

Download
memory/1160-181-0x00007FFABDF80000-0x00007FFABDFBB000-memory.dmp

Filesize
236KB

Download
memory/1160-180-0x00007FFAC13E0000-0x00007FFAC144B000-memory.dmp

Filesize
428KB

Download
memory/1160-179-0x00007FFA9E9C0000-0x00007FFA9EAC2000-memory.dmp

Filesize
1.0MB

Download
memory/1160-178-0x00007FFAA17C0000-0x00007FFAA17F5000-memory.dmp

Filesize
212KB

Download
memory/1160-177-0x00007FFABF350000-0x00007FFABF377000-memory.dmp

Filesize
156KB

Download
memory/1160-163-0x00007FFAC03F0000-0x00007FFAC0591000-memory.dmp

Filesize
1.6MB

Download
memory/1160-183-0x0000000000180000-0x0000000000348000-memory.dmp

Filesize
1.8MB

Download
memory/1160-169-0x00007FFAA3C60000-0x00007FFAA3DAE000-memory.dmp

Filesize
1.3MB

Download
memory/1160-168-0x0000000003300000-0x0000000003341000-memory.dmp

Filesize
260KB

Download
memory/1160-160-0x00007FFAC1060000-0x00007FFAC10FE000-memory.dmp

Filesize
632KB

Download
memory/1160-167-0x0000000000180000-0x0000000000348000-memory.dmp

Filesize
1.8MB

Download
memory/1160-161-0x00007FFABC9F0000-0x00007FFABCA02000-memory.dmp

Filesize
72KB

Download
memory/1160-155-0x0000000000000000-mapping.dmp

Download
memory/1160-165-0x00007FFAC1030000-0x00007FFAC105B000-memory.dmp

Filesize
172KB

Download
memory/1160-164-0x00007FFAA2E00000-0x00007FFAA38C1000-memory.dmp

Filesize
10.8MB

Download
memory/1160-159-0x00007FFAA4360000-0x00007FFAA440A000-memory.dmp

Filesize
680KB

Download
memory/1856-175-0x0000000000000000-mapping.dmp

Download
memory/2132-152-0x0000000000000000-mapping.dmp

Download
memory/3176-173-0x0000000000000000-mapping.dmp

Download
memory/3456-150-0x000002246EA80000-0x000002246EAA2000-memory.dmp

Filesize
136KB

Download
memory/3456-145-0x0000000000000000-mapping.dmp

Download
memory/3456-154-0x00007FFAA2E00000-0x00007FFAA38C1000-memory.dmp

Filesize
10.8MB

Download
memory/3456-153-0x00007FFAA2E00000-0x00007FFAA38C1000-memory.dmp

Filesize
10.8MB

Download
memory/3800-146-0x0000000000000000-mapping.dmp

Download
memory/4308-171-0x0000000000000000-mapping.dmp

Download
memory/4308-176-0x00007FFAA2E00000-0x00007FFAA38C1000-memory.dmp

Filesize
10.8MB

Download
memory/4344-136-0x00007FFAC1060000-0x00007FFAC10FE000-memory.dmp

Filesize
632KB

Download
memory/4344-147-0x00000000007C0000-0x0000000000988000-memory.dmp

Filesize
1.8MB

Download
memory/4344-139-0x00007FFAC03F0000-0x00007FFAC0591000-memory.dmp

Filesize
1.6MB

Download
memory/4344-138-0x00007FFAA3E00000-0x00007FFAA3EBD000-memory.dmp

Filesize
756KB

Download
memory/4344-134-0x00000000007C0000-0x0000000000988000-memory.dmp

Filesize
1.8MB

Download
memory/4344-148-0x0000000000740000-0x0000000000781000-memory.dmp

Filesize
260KB

Download
memory/4344-149-0x00007FFAA2E00000-0x00007FFAA38C1000-memory.dmp

Filesize
10.8MB

Download
memory/4344-133-0x00007FFAA4360000-0x00007FFAA440A000-memory.dmp

Filesize
680KB

Download
memory/4344-135-0x0000000000740000-0x0000000000781000-memory.dmp

Filesize
260KB

Download
memory/4344-137-0x00007FFABC9F0000-0x00007FFABCA02000-memory.dmp

Filesize
72KB

Download
memory/4344-144-0x00007FFAA2E00000-0x00007FFAA38C1000-memory.dmp

Filesize
10.8MB

Download
memory/4344-143-0x00007FFAA3C60000-0x00007FFAA3DAE000-memory.dmp

Filesize
1.3MB

Download
memory/4344-142-0x00000000007C0000-0x0000000000988000-memory.dmp

Filesize
1.8MB

Download
memory/4344-141-0x00007FFAC1030000-0x00007FFAC105B000-memory.dmp

Filesize
172KB

Download
memory/4344-140-0x00007FFAA2E00000-0x00007FFAA38C1000-memory.dmp

Filesize
10.8MB

Download