df65b0462e9733c299ea896850e0b8300d421a95e66177b26177b17d8e4d81f4

Analysis

max time kernel
305s
max time network
357s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CMP_INSUM1056.exe
Size

500.1MB
MD5

acd01714e3836d6f49c34d103bcead06
SHA1

ecc28c1eff2e37edfed50127b3bcc8237d4001c7
SHA256

8d6bd51ded882f8ada6aad7dbcd38e0a6c01b8f2914ccfea4f836d4d030dcf64
SHA512

dd09f10ec1b5f130e99a2984c32d6a99e121368952b09e9ca38fd3d11f323dc1690099eecfb1c2a79e1b74de64f006977a4bf4842b27435f58960ddc7b33a5ad
SSDEEP

1536:rOs6A5IscDvkc0yjPSKFFneIIpsbbPOalcS/MNObZP:rOs6dDl/IpsbbPOalOwZP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CMP_INSUM1056.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	CMP_INSUM1056.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4580 powershell.exe
4580 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

CMP_INSUM1056.exepowershell.exe

description pid process

Token: SeDebugPrivilege 928 CMP_INSUM1056.exe
Token: SeDebugPrivilege 4580 powershell.exe

pid	process
4580	powershell.exe
4580	powershell.exe

description	pid	process
Token: SeDebugPrivilege	928	CMP_INSUM1056.exe
Token: SeDebugPrivilege	4580	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

CMP_INSUM1056.exe

description	pid	process	target process
PID 928 wrote to memory of 4580	928	CMP_INSUM1056.exe	powershell.exe
PID 928 wrote to memory of 4580	928	CMP_INSUM1056.exe	powershell.exe
PID 928 wrote to memory of 4580	928	CMP_INSUM1056.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\CMP_INSUM1056.exe
"C:\Users\Admin\AppData\Local\Temp\CMP_INSUM1056.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANwAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-132-0x00000000005C0000-0x00000000005E4000-memory.dmp

Filesize
144KB

Download
memory/928-133-0x0000000005570000-0x0000000005B14000-memory.dmp

Filesize
5.6MB

Download
memory/928-134-0x0000000004FC0000-0x0000000005052000-memory.dmp

Filesize
584KB

Download
memory/928-135-0x0000000005510000-0x000000000551A000-memory.dmp

Filesize
40KB

Download
memory/928-136-0x0000000000FD0000-0x0000000000FF2000-memory.dmp

Filesize
136KB

Download
memory/4580-137-0x0000000000000000-mapping.dmp

Download
memory/4580-138-0x00000000032F0000-0x0000000003326000-memory.dmp

Filesize
216KB

Download
memory/4580-139-0x00000000059E0000-0x0000000006008000-memory.dmp

Filesize
6.2MB

Download
memory/4580-140-0x0000000005970000-0x00000000059D6000-memory.dmp

Filesize
408KB

Download
memory/4580-141-0x0000000006180000-0x00000000061E6000-memory.dmp

Filesize
408KB

Download
memory/4580-142-0x00000000068C0000-0x00000000068DE000-memory.dmp

Filesize
120KB

Download
memory/4580-143-0x0000000007EF0000-0x000000000856A000-memory.dmp

Filesize
6.5MB

Download
memory/4580-144-0x0000000006DB0000-0x0000000006DCA000-memory.dmp

Filesize
104KB

Download