Analysis
-
max time kernel
259s -
max time network
281s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:53
Static task
static1
Behavioral task
behavioral1
Sample
17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe
Resource
win10v2004-20221111-en
General
-
Target
17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe
-
Size
559KB
-
MD5
bf6fee94cfb3d3074f9b5610c92c8736
-
SHA1
275d6c72eaf3ff795d9c9ce0d8589529117dc3da
-
SHA256
17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43
-
SHA512
db15afafc57b654d3ec119ee6b509ddee62d31cea74cd5ae9ce8811e16f7e3e65571b975d55013311bfc7cd4a3b1dd6e479710275553b119fc8082cbd74810d5
-
SSDEEP
6144:rFhmxTB7drI/7gkzKTr6gQu4ZGhp2y8A/f5c/m6bBApevftP89:vKv6gQu4Aph5QlipeHw
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe" 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe -
Executes dropped EXE 2 IoCs
Processes:
tmp.exenotepad .exepid process 3084 tmp.exe 4428 notepad .exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exe17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exedescription pid process target process PID 1168 set thread context of 4428 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe notepad .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4264 4428 WerFault.exe notepad .exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exepid process 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exedescription pid process Token: SeDebugPrivilege 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.execmd.exewscript.exedescription pid process target process PID 1168 wrote to memory of 1856 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe cmd.exe PID 1168 wrote to memory of 1856 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe cmd.exe PID 1168 wrote to memory of 1856 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe cmd.exe PID 1856 wrote to memory of 3212 1856 cmd.exe wscript.exe PID 1856 wrote to memory of 3212 1856 cmd.exe wscript.exe PID 1856 wrote to memory of 3212 1856 cmd.exe wscript.exe PID 1168 wrote to memory of 3084 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe tmp.exe PID 1168 wrote to memory of 3084 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe tmp.exe PID 1168 wrote to memory of 3084 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe tmp.exe PID 3212 wrote to memory of 2540 3212 wscript.exe cmd.exe PID 3212 wrote to memory of 2540 3212 wscript.exe cmd.exe PID 3212 wrote to memory of 2540 3212 wscript.exe cmd.exe PID 1168 wrote to memory of 4428 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe notepad .exe PID 1168 wrote to memory of 4428 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe notepad .exe PID 1168 wrote to memory of 4428 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe notepad .exe PID 1168 wrote to memory of 4428 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe notepad .exe PID 1168 wrote to memory of 4428 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe notepad .exe PID 1168 wrote to memory of 4428 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe notepad .exe PID 1168 wrote to memory of 4428 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe notepad .exe PID 1168 wrote to memory of 4428 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe notepad .exe PID 1168 wrote to memory of 4428 1168 17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe notepad .exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe"C:\Users\Admin\AppData\Local\Temp\17c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\mata.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\mata2.bat3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mata2.bat" "4⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\notepad .exe"C:\Users\Admin\AppData\Local\Temp\notepad .exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 3483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4428 -ip 44281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\file.exeFilesize
559KB
MD5bf6fee94cfb3d3074f9b5610c92c8736
SHA1275d6c72eaf3ff795d9c9ce0d8589529117dc3da
SHA25617c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43
SHA512db15afafc57b654d3ec119ee6b509ddee62d31cea74cd5ae9ce8811e16f7e3e65571b975d55013311bfc7cd4a3b1dd6e479710275553b119fc8082cbd74810d5
-
C:\Users\Admin\AppData\Local\Temp\invs.vbsFilesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
C:\Users\Admin\AppData\Local\Temp\mata.batFilesize
47B
MD558c538a6ae20a3c6031217903cdf8e5d
SHA1399fd50eadf4945b665877facfc4f53d16e18b1e
SHA2566bcc0e04d9bc32209d90a65c320dc6363e523dd94b38b17bcdc5b980b6405f53
SHA512c01828a5390fec3443e19d317137ae873de77c7737db7802650430e6a0a1edbd3aabe362903243b372536418fbd8482c2a6efd122d853744a41ade567956c359
-
C:\Users\Admin\AppData\Local\Temp\mata2.batFilesize
47B
MD5095b2908ae8b2e0e3704c0163f26e283
SHA13429b6c1421d448c98c1da9625badcea2484a521
SHA25622b182644ab28f5e9e17b5a03ba404d09b02da367146b80484584adc842a3ed1
SHA512e22e379b4f0d8e11fa7c29c3297a3e24a533fb08895d18e9bb27e8cab84da1dd52ff437aca90c5c32a9bdb578b3c1bfb3ff42d3bc2c5951ffeb5941c8286c731
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
C:\Users\Admin\AppData\Local\Temp\rundll11-.txtFilesize
559KB
MD5bf6fee94cfb3d3074f9b5610c92c8736
SHA1275d6c72eaf3ff795d9c9ce0d8589529117dc3da
SHA25617c7284c36afc584e97304bcc919260d74bc51427e41b594f2c31ffe4abd6a43
SHA512db15afafc57b654d3ec119ee6b509ddee62d31cea74cd5ae9ce8811e16f7e3e65571b975d55013311bfc7cd4a3b1dd6e479710275553b119fc8082cbd74810d5
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
68KB
MD5d4879fb623ae695fbb0db7917e36778a
SHA198aac1553a2362a112df26fec7239d7c4656655d
SHA2560fca46b7d77046cb9bf84271f8ea678f8f950bc7ebc81ac7e2c5afd3e96f41c3
SHA5124f129dc31548a05889e2e124f9885a59895c56b8ccef5ad9ad28084f690b657efaa667504cb0e4495fac83a13c76f836404e6178be4e539737013b5b71a79e78
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
68KB
MD5d4879fb623ae695fbb0db7917e36778a
SHA198aac1553a2362a112df26fec7239d7c4656655d
SHA2560fca46b7d77046cb9bf84271f8ea678f8f950bc7ebc81ac7e2c5afd3e96f41c3
SHA5124f129dc31548a05889e2e124f9885a59895c56b8ccef5ad9ad28084f690b657efaa667504cb0e4495fac83a13c76f836404e6178be4e539737013b5b71a79e78
-
memory/1168-132-0x0000000074A50000-0x0000000075001000-memory.dmpFilesize
5.7MB
-
memory/1168-142-0x0000000074A50000-0x0000000075001000-memory.dmpFilesize
5.7MB
-
memory/1168-152-0x0000000074A50000-0x0000000075001000-memory.dmpFilesize
5.7MB
-
memory/1856-133-0x0000000000000000-mapping.dmp
-
memory/2540-139-0x0000000000000000-mapping.dmp
-
memory/3084-138-0x0000000000000000-mapping.dmp
-
memory/3212-135-0x0000000000000000-mapping.dmp
-
memory/4428-145-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4428-144-0x0000000000000000-mapping.dmp
-
memory/4428-149-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB