Analysis
-
max time kernel
101s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 22:16
Static task
static1
Behavioral task
behavioral1
Sample
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe
Resource
win7-20220812-en
General
-
Target
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe
-
Size
875KB
-
MD5
0a73ff03793f0b5beb7d2537933033ab
-
SHA1
9631cedd0844c8c7fb16373c27e0c9ffb7261f9a
-
SHA256
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563
-
SHA512
4131c9e9bbdd3618cdda5cf00b98f2d2254e63ce6a6d5bafda9bd6430e3c555e6361227bfe89072e83f46e0dd4c8d306b9337570800760bb612917c17517d703
-
SSDEEP
24576:h4lavt0LkLL9IMixoEgea+8zrcq9MmCS:wkwkn9IMHea+GQaPCS
Malware Config
Signatures
-
Processes:
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe -
Executes dropped EXE 2 IoCs
Processes:
7163.exetext.exepid process 3628 7163.exe 2032 text.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe7163.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 7163.exe -
Processes:
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe7163.exedescription pid process target process PID 1852 wrote to memory of 3628 1852 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe 7163.exe PID 1852 wrote to memory of 3628 1852 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe 7163.exe PID 1852 wrote to memory of 3628 1852 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe 7163.exe PID 3628 wrote to memory of 2032 3628 7163.exe text.exe PID 3628 wrote to memory of 2032 3628 7163.exe text.exe PID 3628 wrote to memory of 2032 3628 7163.exe text.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe"C:\Users\Admin\AppData\Local\Temp\90879c6b4db8254f1e2ec94ec3ea453977a251c1789e91879a863504c2aaa563.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\7163\7163.exe"C:\Users\Admin\AppData\Local\Temp\7163\7163.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\text.exe"C:\Users\Admin\AppData\Roaming\text.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7163\7163.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
C:\Users\Admin\AppData\Local\Temp\7163\7163.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
C:\Users\Admin\AppData\Roaming\text.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
C:\Users\Admin\AppData\Roaming\text.exeFilesize
28KB
MD5f2cb40517f296c958053e0d6752d6e66
SHA1d90652c7f3501b898a902be6abec0b52e2abbeee
SHA2562187b8f08b50c9e5d525007f42f8c960ecf6257d0e57d5435b2b61c02c6d9267
SHA5127de89af47e8a4f5d60f88d156767546360715fbe268a12be57ec9227ba24cbcd64dc5a0c85526a743728de4b7f5b91b8736fc49c11a90b8520ecbf51ca8a6d59
-
memory/2032-135-0x0000000000000000-mapping.dmp
-
memory/2032-139-0x00000000734D0000-0x0000000073A81000-memory.dmpFilesize
5.7MB
-
memory/3628-132-0x0000000000000000-mapping.dmp
-
memory/3628-138-0x00000000734D0000-0x0000000073A81000-memory.dmpFilesize
5.7MB
-
memory/3628-140-0x00000000734D0000-0x0000000073A81000-memory.dmpFilesize
5.7MB