Analysis

  • max time kernel
    187s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 13:23

General

  • Target

    ad9a87e05f2af8be3be9f3922ec82714cc5fab527b4c8fde1a1d4cd628c9b2af.exe

  • Size

    195KB

  • MD5

    7bbec57cf98fcb917ffe80d2de6c1c19

  • SHA1

    901c9e69a6da069a32a1f2f467d9cd5610ac7142

  • SHA256

    ad9a87e05f2af8be3be9f3922ec82714cc5fab527b4c8fde1a1d4cd628c9b2af

  • SHA512

    ed5d65e5279565c177f3f49327916482d00f55c6ea0fe4d589cfc1ec31eddb2c673dc976c38e0520f991d79f25f167bc7a18d435c8c874d537ab6a780ec4d2eb

  • SSDEEP

    6144:HDHyVG/j8MmXN6DV5sPYOI+oZCSaRpJ/miF:jSs/AMmXoD3uYOImSaRHuiF

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad9a87e05f2af8be3be9f3922ec82714cc5fab527b4c8fde1a1d4cd628c9b2af.exe
    "C:\Users\Admin\AppData\Local\Temp\ad9a87e05f2af8be3be9f3922ec82714cc5fab527b4c8fde1a1d4cd628c9b2af.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe
      "C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1172

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe

    Filesize

    195KB

    MD5

    7bbec57cf98fcb917ffe80d2de6c1c19

    SHA1

    901c9e69a6da069a32a1f2f467d9cd5610ac7142

    SHA256

    ad9a87e05f2af8be3be9f3922ec82714cc5fab527b4c8fde1a1d4cd628c9b2af

    SHA512

    ed5d65e5279565c177f3f49327916482d00f55c6ea0fe4d589cfc1ec31eddb2c673dc976c38e0520f991d79f25f167bc7a18d435c8c874d537ab6a780ec4d2eb

  • C:\Users\Admin\AppData\Roaming\steamwebhelper2\steamwebhelper.exe

    Filesize

    195KB

    MD5

    7bbec57cf98fcb917ffe80d2de6c1c19

    SHA1

    901c9e69a6da069a32a1f2f467d9cd5610ac7142

    SHA256

    ad9a87e05f2af8be3be9f3922ec82714cc5fab527b4c8fde1a1d4cd628c9b2af

    SHA512

    ed5d65e5279565c177f3f49327916482d00f55c6ea0fe4d589cfc1ec31eddb2c673dc976c38e0520f991d79f25f167bc7a18d435c8c874d537ab6a780ec4d2eb

  • memory/1172-137-0x0000000000000000-mapping.dmp

  • memory/1172-141-0x00007FFFF21B0000-0x00007FFFF2C71000-memory.dmp

    Filesize

    10.8MB

  • memory/1172-142-0x00007FFFF21B0000-0x00007FFFF2C71000-memory.dmp

    Filesize

    10.8MB

  • memory/4636-135-0x0000000000D30000-0x0000000000D66000-memory.dmp

    Filesize

    216KB

  • memory/4636-136-0x00007FFFF21B0000-0x00007FFFF2C71000-memory.dmp

    Filesize

    10.8MB

  • memory/4636-140-0x00007FFFF21B0000-0x00007FFFF2C71000-memory.dmp

    Filesize

    10.8MB