6bda3e2b454fc9946b572c8e43a3e9e3105931a94a69073c93cd507333a70886

Analysis

max time kernel
52s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

violett/violett_checker.exe
Size

16.7MB
MD5

8b19826d2a8fb9801d8e33b668fbb435
SHA1

940b8ef66a98f89ac19b40bd738e4f4efedf5445
SHA256

3cd716bb2a413584ddd75c8dbc813e337c77e8ae424353f9ade226f25de81813
SHA512

3dd6da80af4617ad2f8755773ad719455138a6b4d612061755e4ab5d278cfee936d57bf6bc770ee74bdd1313640b33043d4c9e52258b4d33532453c1619c62bd
SSDEEP

393216:5naV9L0TrymvAHgUMJv39kRe5FMMpjAMhVuVOPW:U9L06mpbv3nvpjAMhV8O

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

violettchecker.exesvchost.exe

pid process

4364 violettchecker.exe
1836 svchost.exe

pid	process
4364	violettchecker.exe
1836	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

violett_checker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	violett_checker.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

violettchecker.exe

pid process

4364 violettchecker.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

violettchecker.exe

pid process

4364 violettchecker.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

violettchecker.exe

pid process

4364 violettchecker.exe

pid	process
4364	violettchecker.exe

pid	process
4364	violettchecker.exe

pid	process
4364	violettchecker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

violett_checker.exe

description	pid	process	target process
PID 1828 wrote to memory of 4364	1828	violett_checker.exe	violettchecker.exe
PID 1828 wrote to memory of 4364	1828	violett_checker.exe	violettchecker.exe
PID 1828 wrote to memory of 1836	1828	violett_checker.exe	svchost.exe
PID 1828 wrote to memory of 1836	1828	violett_checker.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\violett\violett_checker.exe
"C:\Users\Admin\AppData\Local\Temp\violett\violett_checker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1828

C:\Users\Admin\AppData\Local\Temp\violettchecker.exe
"C:\Users\Admin\AppData\Local\Temp\violettchecker.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4364

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
40KB

MD5
70e4d5e6bb47542d9a03d2c9992bcce2

SHA1
1f96ccb5df4defcfd4ab433d71d8f08500c8fcd2

SHA256
6f5d468a66247b4c88d3750f6478720ddd7058b2d49b3b08e2d176a1bb5a5f84

SHA512
2513dba8a843d841a8d4b2ebdf0220b853e8e90e37b986dffe856fb874f713b08369318b55e0981212c9924d1c156bf35470c472f8e36327b92842d0e3f4a0aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
40KB

MD5
70e4d5e6bb47542d9a03d2c9992bcce2

SHA1
1f96ccb5df4defcfd4ab433d71d8f08500c8fcd2

SHA256
6f5d468a66247b4c88d3750f6478720ddd7058b2d49b3b08e2d176a1bb5a5f84

SHA512
2513dba8a843d841a8d4b2ebdf0220b853e8e90e37b986dffe856fb874f713b08369318b55e0981212c9924d1c156bf35470c472f8e36327b92842d0e3f4a0aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\violettchecker.exe
Filesize
16.6MB

MD5
00c9e8a4703997c615d8d8d57fff3671

SHA1
7fef4fc99d931f907b60fad34eba9b2eaee83b7e

SHA256
ba8d2e5e2dfb39afcbba1b7be45237b22715f14f19ec1dacb17d083a3fe3c236

SHA512
40d703d58f9e49758aa56bba318375291a3e4cf1f96531d5e088eeb133667ee43a45f8794accdb76fe266d532ad93b4a3d2fb59c19e8adff1686325d37a68fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\violettchecker.exe
Filesize
16.6MB

MD5
00c9e8a4703997c615d8d8d57fff3671

SHA1
7fef4fc99d931f907b60fad34eba9b2eaee83b7e

SHA256
ba8d2e5e2dfb39afcbba1b7be45237b22715f14f19ec1dacb17d083a3fe3c236

SHA512
40d703d58f9e49758aa56bba318375291a3e4cf1f96531d5e088eeb133667ee43a45f8794accdb76fe266d532ad93b4a3d2fb59c19e8adff1686325d37a68fbe

Download Submit
memory/1836-135-0x0000000000000000-mapping.dmp

Download
memory/1836-138-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1836-139-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/1836-140-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/4364-132-0x0000000000000000-mapping.dmp

Download