Analysis
-
max time kernel
126s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:59
Static task
static1
Behavioral task
behavioral1
Sample
427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.exe
Resource
win10v2004-20220812-en
General
-
Target
427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.exe
-
Size
2.4MB
-
MD5
d6f5a6aa8744d4357a12a92d6ba3e6ca
-
SHA1
9ec104b8d2cdde80abe7384868de56085c9901c8
-
SHA256
427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e
-
SHA512
9c03e06289b11591e0fceb5d9b3be55b25bf42597305f09846899edf649079423ae4cd11c320ce2185b2a7366b2a151f21fecc8b84f64cf19309c3f1fcdb6a12
-
SSDEEP
49152:wc//////0Tn3nEnJYPnSAvFZ3DQ7qoW4hDvu4z5NvamUDkYnW19AQ1K:wc//////oEnJozNZTQ7qoW34Dt4VnoAT
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
scvhosts.exe°ÄÃÅʱʱ²Ê¿ØÖÆ̨.exescvhostsmonitype.exepid process 4304 scvhosts.exe 2408 °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe 4172 scvhosts 1428 monitype.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
°ÄÃÅʱʱ²Ê¿ØÖÆ̨.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe -
Loads dropped DLL 1 IoCs
Processes:
monitype.exepid process 1428 monitype.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
scvhosts.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Run scvhosts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scvhosts = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\scvhosts\"" scvhosts.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
monitype.exepid process 1428 monitype.exe 1428 monitype.exe 1428 monitype.exe 1428 monitype.exe -
Drops file in Program Files directory 14 IoCs
Processes:
scvhosts.exe°ÄÃÅʱʱ²Ê¿ØÖÆ̨.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhosts scvhosts.exe File opened for modification C:\Program Files (x86)\澳门时时彩控制台 °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe File created C:\Program Files (x86)\澳门时时彩控制台\__tmp_rar_sfx_access_check_240555890 °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe File opened for modification C:\Program Files (x86)\澳门时时彩控制台\type.wav °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe File created C:\Program Files (x86)\澳门时时彩控制台\monitype.exe °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe File created C:\Program Files (x86)\澳门时时彩控制台\od_gate_dll.dll °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe File created C:\Program Files (x86)\澳门时时彩控制台\beep1.wav °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe File opened for modification C:\Program Files (x86)\澳门时时彩控制台\beep1.wav °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhosts scvhosts.exe File created C:\Program Files (x86)\澳门时时彩控制台\type.wav °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe File opened for modification C:\Program Files (x86)\澳门时时彩控制台\monitype.exe °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe File opened for modification C:\Program Files (x86)\澳门时时彩控制台\od_gate_dll.dll °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe File created C:\Program Files (x86)\澳门时时彩控制台\login.ini °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe File opened for modification C:\Program Files (x86)\澳门时时彩控制台\login.ini °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1144 1428 WerFault.exe monitype.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
scvhostsdescription pid process Token: SeIncBasePriorityPrivilege 4172 scvhosts Token: SeIncBasePriorityPrivilege 4172 scvhosts Token: SeIncBasePriorityPrivilege 4172 scvhosts -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.execmd.execmd.exescvhosts.exe°ÄÃÅʱʱ²Ê¿ØÖÆ̨.exedescription pid process target process PID 4848 wrote to memory of 4744 4848 427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.exe cmd.exe PID 4848 wrote to memory of 4744 4848 427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.exe cmd.exe PID 4848 wrote to memory of 4744 4848 427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.exe cmd.exe PID 4848 wrote to memory of 2728 4848 427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.exe cmd.exe PID 4848 wrote to memory of 2728 4848 427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.exe cmd.exe PID 4848 wrote to memory of 2728 4848 427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.exe cmd.exe PID 4744 wrote to memory of 4304 4744 cmd.exe scvhosts.exe PID 4744 wrote to memory of 4304 4744 cmd.exe scvhosts.exe PID 4744 wrote to memory of 4304 4744 cmd.exe scvhosts.exe PID 2728 wrote to memory of 2408 2728 cmd.exe °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe PID 2728 wrote to memory of 2408 2728 cmd.exe °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe PID 2728 wrote to memory of 2408 2728 cmd.exe °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe PID 4304 wrote to memory of 4172 4304 scvhosts.exe scvhosts PID 4304 wrote to memory of 4172 4304 scvhosts.exe scvhosts PID 4304 wrote to memory of 4172 4304 scvhosts.exe scvhosts PID 2408 wrote to memory of 1428 2408 °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe monitype.exe PID 2408 wrote to memory of 1428 2408 °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe monitype.exe PID 2408 wrote to memory of 1428 2408 °ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe monitype.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.exe"C:\Users\Admin\AppData\Local\Temp\427ad4f97f5062e2480bac6c80efc61f9eeb0b016cd2f202fbeaa2be4cea8c9e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\scvhosts.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\scvhosts.exeC:\Users\Admin\AppData\Local\Temp\scvhosts.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhosts"C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhosts"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\°ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\°ÄÃÅʱʱ²Ê¿ØÖÆ̨.exeC:\Users\Admin\AppData\Local\Temp\°ÄÃÅʱʱ²Ê¿ØÖÆ̨.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\澳门时时彩控制台\monitype.exe"C:\Program Files (x86)\澳门时时彩控制台\monitype.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 9765⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1428 -ip 14281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\澳门时时彩控制台\monitype.exeFilesize
2.0MB
MD5f7ca931393bd7191331d147330ec5f24
SHA104e95da62011a1b47cc20c11485cef2a2b3877fd
SHA2561187cee0b192fb2e66cd1e49269725e84dfd333c5cb21d7534d9e1ddaff87552
SHA512ff2a6bfc8681b924030c112dcdb26d6045a5a12202606c697339c1329c0d42651983841c2c53f2ad0c4ab48960d5fd92070bdf4e7e0a2dba5e1329734dc927c3
-
C:\Program Files (x86)\澳门时时彩控制台\monitype.exeFilesize
2.0MB
MD5f7ca931393bd7191331d147330ec5f24
SHA104e95da62011a1b47cc20c11485cef2a2b3877fd
SHA2561187cee0b192fb2e66cd1e49269725e84dfd333c5cb21d7534d9e1ddaff87552
SHA512ff2a6bfc8681b924030c112dcdb26d6045a5a12202606c697339c1329c0d42651983841c2c53f2ad0c4ab48960d5fd92070bdf4e7e0a2dba5e1329734dc927c3
-
C:\Program Files (x86)\澳门时时彩控制台\od_gate_dll.dllFilesize
264KB
MD545713c1a2f65f41b2f58f9af30a77d9a
SHA1d33479e3acfe3b35ba8a3778f6550ef5bf5177e7
SHA256111d92d44bca796ccf48e0278196d27b52116b10e9ed7434f84aaaddce78ac23
SHA51244665dc6e9e8a9361895a9eac2b6dc7000284fbadea51f5368eaa94b622526c217162da55520798f2a7e2b3eecd444d531d76fa9fcd17115ae08d3206282d508
-
C:\Program Files (x86)\澳门时时彩控制台\od_gate_dll.dllFilesize
264KB
MD545713c1a2f65f41b2f58f9af30a77d9a
SHA1d33479e3acfe3b35ba8a3778f6550ef5bf5177e7
SHA256111d92d44bca796ccf48e0278196d27b52116b10e9ed7434f84aaaddce78ac23
SHA51244665dc6e9e8a9361895a9eac2b6dc7000284fbadea51f5368eaa94b622526c217162da55520798f2a7e2b3eecd444d531d76fa9fcd17115ae08d3206282d508
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhostsFilesize
682KB
MD59259add01be737bf2cfecfb24e57f279
SHA1d756e6113ab2cc61c1fdf4d6dcda6b75832d1b93
SHA256645598749b9407965214fb267b28ed2b8ee05d2c4bcad55bffce301a1cfd863c
SHA5125bfce35f419ed7623bf260f8d7eb0d76a910afe20662ec346adbc18a1cbc210f19e2b707472c51f05be5561e9a7426b14f7d9e7b0b64976d818a4ec9742fa507
-
C:\Program Files\Common Files\microsoft shared\MSInfo\scvhostsFilesize
682KB
MD59259add01be737bf2cfecfb24e57f279
SHA1d756e6113ab2cc61c1fdf4d6dcda6b75832d1b93
SHA256645598749b9407965214fb267b28ed2b8ee05d2c4bcad55bffce301a1cfd863c
SHA5125bfce35f419ed7623bf260f8d7eb0d76a910afe20662ec346adbc18a1cbc210f19e2b707472c51f05be5561e9a7426b14f7d9e7b0b64976d818a4ec9742fa507
-
C:\Users\Admin\AppData\Local\Temp\scvhosts.exeFilesize
682KB
MD59259add01be737bf2cfecfb24e57f279
SHA1d756e6113ab2cc61c1fdf4d6dcda6b75832d1b93
SHA256645598749b9407965214fb267b28ed2b8ee05d2c4bcad55bffce301a1cfd863c
SHA5125bfce35f419ed7623bf260f8d7eb0d76a910afe20662ec346adbc18a1cbc210f19e2b707472c51f05be5561e9a7426b14f7d9e7b0b64976d818a4ec9742fa507
-
C:\Users\Admin\AppData\Local\Temp\scvhosts.exeFilesize
682KB
MD59259add01be737bf2cfecfb24e57f279
SHA1d756e6113ab2cc61c1fdf4d6dcda6b75832d1b93
SHA256645598749b9407965214fb267b28ed2b8ee05d2c4bcad55bffce301a1cfd863c
SHA5125bfce35f419ed7623bf260f8d7eb0d76a910afe20662ec346adbc18a1cbc210f19e2b707472c51f05be5561e9a7426b14f7d9e7b0b64976d818a4ec9742fa507
-
C:\Users\Admin\AppData\Local\Temp\°ÄÃÅʱʱ²Ê¿ØÖÆ̨.exeFilesize
1.6MB
MD5f95dac4cb9e87759aab023544be9ebf7
SHA15bf6e6cf3b56671ec9fbf25d069ded39215c4c3c
SHA256138ba1874e071e041564b6a9c1ac838df373587f965a57abdd599f364bec9920
SHA512293f72c43e6e4b5e21df84a24c75b187e4576599de96bc92bb3147db24c22c54dfb9cc74c29343f0116364dcb34d92a37b5f5709d69e7770cb4465b556b9dbe4
-
C:\Users\Admin\AppData\Local\Temp\°ÄÃÅʱʱ²Ê¿ØÖÆ̨.exeFilesize
1.6MB
MD5f95dac4cb9e87759aab023544be9ebf7
SHA15bf6e6cf3b56671ec9fbf25d069ded39215c4c3c
SHA256138ba1874e071e041564b6a9c1ac838df373587f965a57abdd599f364bec9920
SHA512293f72c43e6e4b5e21df84a24c75b187e4576599de96bc92bb3147db24c22c54dfb9cc74c29343f0116364dcb34d92a37b5f5709d69e7770cb4465b556b9dbe4
-
memory/1428-1496-0x0000000000400000-0x0000000000737000-memory.dmpFilesize
3.2MB
-
memory/1428-1497-0x0000000000400000-0x0000000000737000-memory.dmpFilesize
3.2MB
-
memory/1428-150-0x0000000075360000-0x0000000075575000-memory.dmpFilesize
2.1MB
-
memory/1428-152-0x00000000756B0000-0x0000000075850000-memory.dmpFilesize
1.6MB
-
memory/1428-1501-0x0000000000400000-0x0000000000737000-memory.dmpFilesize
3.2MB
-
memory/1428-1500-0x0000000002860000-0x0000000002960000-memory.dmpFilesize
1024KB
-
memory/1428-148-0x0000000000400000-0x0000000000737000-memory.dmpFilesize
3.2MB
-
memory/1428-149-0x0000000076F70000-0x0000000077113000-memory.dmpFilesize
1.6MB
-
memory/1428-1499-0x0000000000400000-0x0000000000737000-memory.dmpFilesize
3.2MB
-
memory/1428-1502-0x0000000000400000-0x0000000000737000-memory.dmpFilesize
3.2MB
-
memory/1428-1495-0x0000000000400000-0x0000000000737000-memory.dmpFilesize
3.2MB
-
memory/1428-153-0x0000000075A10000-0x0000000075A8A000-memory.dmpFilesize
488KB
-
memory/1428-1498-0x0000000000400000-0x0000000000737000-memory.dmpFilesize
3.2MB
-
memory/1428-143-0x0000000000000000-mapping.dmp
-
memory/2408-137-0x0000000000000000-mapping.dmp
-
memory/2728-133-0x0000000000000000-mapping.dmp
-
memory/4172-140-0x0000000000000000-mapping.dmp
-
memory/4304-134-0x0000000000000000-mapping.dmp
-
memory/4744-132-0x0000000000000000-mapping.dmp