Analysis
-
max time kernel
185s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:51
Static task
static1
Behavioral task
behavioral1
Sample
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe
Resource
win10v2004-20221111-en
General
-
Target
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe
-
Size
710KB
-
MD5
b41be72917631662b809a97398b1cc2f
-
SHA1
86ffe8c475013335a595e45e61555d218c83ed6c
-
SHA256
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55
-
SHA512
e6bd8298c1df98ca1d2954d419032d559afd17e55f82dcc9840114c7f8a0bb85b1eb74f84d832b172a4ba59f32fe1770db4419909fb73e83a96dacd3a79b8b39
-
SSDEEP
12288:8CcefLVxfez9WRoEwnHKMrMCFJEHylS43u6Zmpin3J:wQLV8zcRoTjw+JFsin
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe" e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exepid process 1620 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe 1620 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exedescription pid process Token: SeDebugPrivilege 1620 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.execmd.exewscript.exedescription pid process target process PID 1620 wrote to memory of 1812 1620 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe cmd.exe PID 1620 wrote to memory of 1812 1620 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe cmd.exe PID 1620 wrote to memory of 1812 1620 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe cmd.exe PID 1812 wrote to memory of 5100 1812 cmd.exe wscript.exe PID 1812 wrote to memory of 5100 1812 cmd.exe wscript.exe PID 1812 wrote to memory of 5100 1812 cmd.exe wscript.exe PID 1620 wrote to memory of 2000 1620 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 1620 wrote to memory of 2000 1620 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 1620 wrote to memory of 2000 1620 e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe notepad .exe PID 5100 wrote to memory of 3736 5100 wscript.exe cmd.exe PID 5100 wrote to memory of 3736 5100 wscript.exe cmd.exe PID 5100 wrote to memory of 3736 5100 wscript.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe"C:\Users\Admin\AppData\Local\Temp\e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\mata.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\mata2.bat3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mata2.bat" "4⤵
-
C:\Users\Admin\AppData\Local\Temp\notepad .exe"C:\Users\Admin\AppData\Local\Temp\notepad .exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\file.exeFilesize
710KB
MD5b41be72917631662b809a97398b1cc2f
SHA186ffe8c475013335a595e45e61555d218c83ed6c
SHA256e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55
SHA512e6bd8298c1df98ca1d2954d419032d559afd17e55f82dcc9840114c7f8a0bb85b1eb74f84d832b172a4ba59f32fe1770db4419909fb73e83a96dacd3a79b8b39
-
C:\Users\Admin\AppData\Local\Temp\invs.vbsFilesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
C:\Users\Admin\AppData\Local\Temp\mata.batFilesize
47B
MD558c538a6ae20a3c6031217903cdf8e5d
SHA1399fd50eadf4945b665877facfc4f53d16e18b1e
SHA2566bcc0e04d9bc32209d90a65c320dc6363e523dd94b38b17bcdc5b980b6405f53
SHA512c01828a5390fec3443e19d317137ae873de77c7737db7802650430e6a0a1edbd3aabe362903243b372536418fbd8482c2a6efd122d853744a41ade567956c359
-
C:\Users\Admin\AppData\Local\Temp\mata2.batFilesize
47B
MD5095b2908ae8b2e0e3704c0163f26e283
SHA13429b6c1421d448c98c1da9625badcea2484a521
SHA25622b182644ab28f5e9e17b5a03ba404d09b02da367146b80484584adc842a3ed1
SHA512e22e379b4f0d8e11fa7c29c3297a3e24a533fb08895d18e9bb27e8cab84da1dd52ff437aca90c5c32a9bdb578b3c1bfb3ff42d3bc2c5951ffeb5941c8286c731
-
C:\Users\Admin\AppData\Local\Temp\rundll11-.txtFilesize
710KB
MD5b41be72917631662b809a97398b1cc2f
SHA186ffe8c475013335a595e45e61555d218c83ed6c
SHA256e52686afa294deeb54086ecaedaa073a6a95d4df0d8b7810185cd664c773be55
SHA512e6bd8298c1df98ca1d2954d419032d559afd17e55f82dcc9840114c7f8a0bb85b1eb74f84d832b172a4ba59f32fe1770db4419909fb73e83a96dacd3a79b8b39
-
memory/1620-132-0x0000000074E50000-0x0000000075401000-memory.dmpFilesize
5.7MB
-
memory/1620-141-0x0000000074E50000-0x0000000075401000-memory.dmpFilesize
5.7MB
-
memory/1620-143-0x0000000074E50000-0x0000000075401000-memory.dmpFilesize
5.7MB
-
memory/1812-133-0x0000000000000000-mapping.dmp
-
memory/2000-136-0x0000000000000000-mapping.dmp
-
memory/3736-139-0x0000000000000000-mapping.dmp
-
memory/5100-135-0x0000000000000000-mapping.dmp