Analysis
-
max time kernel
170s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:39
Static task
static1
Behavioral task
behavioral1
Sample
84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe
Resource
win10v2004-20220812-en
General
-
Target
84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe
-
Size
84KB
-
MD5
33e70b85a6b35f3dc4cfa5810572c728
-
SHA1
2ea035b18b318feb303d86884fecf7fb474ed8e8
-
SHA256
84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab
-
SHA512
82bb5628f52551d87b743ea1b1e58bf7df363a447a4a1806e6cd9dc377a0671100d14232df239cdf4955f46f9729d817f748cbb5af992f0a6090fb25be61d016
-
SSDEEP
1536:Tz2LOAmYhzihenoFV8pcr3XQtHeddSJ/M+/bbQ5sXHxmHpTrTytTKmIaaaM/8aav:Tz2LOAjQen0Ete4/Z/bbU6RkgNIaaaN/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
local.exepid process 1092 local.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
local.exepid process 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe 1092 local.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
local.exedescription pid process Token: SeDebugPrivilege 1092 local.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exelocal.exedescription pid process target process PID 4988 wrote to memory of 1092 4988 84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe local.exe PID 4988 wrote to memory of 1092 4988 84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe local.exe PID 4988 wrote to memory of 1092 4988 84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe local.exe PID 1092 wrote to memory of 1472 1092 local.exe netsh.exe PID 1092 wrote to memory of 1472 1092 local.exe netsh.exe PID 1092 wrote to memory of 1472 1092 local.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe"C:\Users\Admin\AppData\Local\Temp\84ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\local.exe"C:\Users\Admin\AppData\Local\Temp\local.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\local.exe" "local.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\local.exeFilesize
84KB
MD533e70b85a6b35f3dc4cfa5810572c728
SHA12ea035b18b318feb303d86884fecf7fb474ed8e8
SHA25684ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab
SHA51282bb5628f52551d87b743ea1b1e58bf7df363a447a4a1806e6cd9dc377a0671100d14232df239cdf4955f46f9729d817f748cbb5af992f0a6090fb25be61d016
-
C:\Users\Admin\AppData\Local\Temp\local.exeFilesize
84KB
MD533e70b85a6b35f3dc4cfa5810572c728
SHA12ea035b18b318feb303d86884fecf7fb474ed8e8
SHA25684ade438ef66e6771445a3cc4fabf779aa6883ea01c39e99b2e0134defcc51ab
SHA51282bb5628f52551d87b743ea1b1e58bf7df363a447a4a1806e6cd9dc377a0671100d14232df239cdf4955f46f9729d817f748cbb5af992f0a6090fb25be61d016
-
memory/1092-134-0x0000000000000000-mapping.dmp
-
memory/1092-138-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/1092-139-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/1472-140-0x0000000000000000-mapping.dmp
-
memory/4988-132-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/4988-133-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/4988-137-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB