Overview

overview

9

Static

static

8b951df5a8...ff.exe

windows7-x64

9

8b951df5a8...ff.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 15:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe

  • Size

    627KB

  • MD5

    c0dbf7da39a106dd0bd52425ecc7c7fb

  • SHA1

    2e3e1013e2c37b2e494b1d21fad30535e0c95c56

  • SHA256

    8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff

  • SHA512

    7573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c

  • SSDEEP

    12288:DHGMlyPzdD0cxpxX7/cTb8rMpyRZfMgoCvUFhi:bqPL1rgAYuZL

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe
    "C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe
      "C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c copy /z "C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"
        3⤵
        • Drops startup file
        PID:5064
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        dw20.exe -x -s 2492
        3⤵
        • Drops file in Windows directory
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1460
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5104
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1416
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4488
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c copy /z "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acctres.exe"
            5⤵
            • Drops startup file
            PID:1116
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
            dw20.exe -x -s 2468
            5⤵
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious use of AdjustPrivilegeToken
            PID:1776
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          PID:4724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WUDHost.exe.log
    Filesize

    224B

    MD5

    c19eb8c8e7a40e6b987f9d2ee952996e

    SHA1

    6fc3049855bc9100643e162511673c6df0f28bfb

    SHA256

    677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a

    SHA512

    860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
    Filesize

    627KB

    MD5

    c0dbf7da39a106dd0bd52425ecc7c7fb

    SHA1

    2e3e1013e2c37b2e494b1d21fad30535e0c95c56

    SHA256

    8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff

    SHA512

    7573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
    Filesize

    627KB

    MD5

    c0dbf7da39a106dd0bd52425ecc7c7fb

    SHA1

    2e3e1013e2c37b2e494b1d21fad30535e0c95c56

    SHA256

    8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff

    SHA512

    7573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
    Filesize

    627KB

    MD5

    c0dbf7da39a106dd0bd52425ecc7c7fb

    SHA1

    2e3e1013e2c37b2e494b1d21fad30535e0c95c56

    SHA256

    8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff

    SHA512

    7573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
    Filesize

    6KB

    MD5

    e60d6745837845b4797f6266fdeb756d

    SHA1

    bd4a42994d2c4ced86722e5f0cbc770eed89b538

    SHA256

    af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2

    SHA512

    2a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
    Filesize

    6KB

    MD5

    e60d6745837845b4797f6266fdeb756d

    SHA1

    bd4a42994d2c4ced86722e5f0cbc770eed89b538

    SHA256

    af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2

    SHA512

    2a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
    Filesize

    6KB

    MD5

    e60d6745837845b4797f6266fdeb756d

    SHA1

    bd4a42994d2c4ced86722e5f0cbc770eed89b538

    SHA256

    af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2

    SHA512

    2a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
    Filesize

    6KB

    MD5

    e60d6745837845b4797f6266fdeb756d

    SHA1

    bd4a42994d2c4ced86722e5f0cbc770eed89b538

    SHA256

    af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2

    SHA512

    2a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc

    Download Submit
  • memory/1116-159-0x0000000000000000-mapping.dmp
    Download
  • memory/1416-148-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1416-145-0x0000000000000000-mapping.dmp
    Download
  • memory/1416-149-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1460-142-0x0000000000000000-mapping.dmp
    Download
  • memory/1776-162-0x0000000000000000-mapping.dmp
    Download
  • memory/4488-152-0x0000000000000000-mapping.dmp
    Download
  • memory/4488-160-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4488-163-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4560-136-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4560-135-0x0000000000400000-0x0000000000476000-memory.dmp
    Filesize

    472KB

    Download
  • memory/4560-134-0x0000000000000000-mapping.dmp
    Download
  • memory/4560-143-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4724-161-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4724-164-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4724-155-0x0000000000000000-mapping.dmp
    Download
  • memory/4864-132-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4864-151-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4864-133-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/5064-138-0x0000000000000000-mapping.dmp
    Download
  • memory/5104-137-0x0000000000000000-mapping.dmp
    Download
  • memory/5104-141-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/5104-144-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/5104-150-0x00000000753A0000-0x0000000075951000-memory.dmp
    Filesize

    5.7MB

    Download