Analysis
-
max time kernel
151s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 02:15
Static task
static1
Behavioral task
behavioral1
Sample
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe
Resource
win10v2004-20220901-en
General
-
Target
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe
-
Size
422KB
-
MD5
554c3f24b05707d2b19bf38507598d76
-
SHA1
d97f51df068df55952aa8c04262bebcad9854d11
-
SHA256
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725
-
SHA512
7c7c952285de0f8c57c6a87abec26936dadc7abf5263b783c4ac6135d7a18f4dfa42fc05aaf5ad0b791f2e741016496e22201e751e532eb55a0f113fd92e9328
-
SSDEEP
6144:T+jJxTnGqaR6rlsG6LbrVSlKR85hIp81G5NQu604EPyl3VQdF02nPVllvjAfTIj:EJMNorlsG6ZR8Z6NZylwFpPVl2Ij
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
Processes:
REG.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" REG.exe -
Executes dropped EXE 2 IoCs
Processes:
Intel.exeIntel.exepid process 4604 Intel.exe 4924 Intel.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe -
Drops startup file 1 IoCs
Processes:
Intel.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel.com.url Intel.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel = "C:\\ProgramData\\Intel.exe" reg.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exeIntel.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Intel.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Intel.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Intel.exedescription pid process target process PID 4604 set thread context of 4924 4604 Intel.exe Intel.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Intel.exepid process 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe 4604 Intel.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exeIntel.exedescription pid process Token: SeDebugPrivilege 4956 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Token: SeDebugPrivilege 4604 Intel.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.execmd.exeIntel.exedescription pid process target process PID 4956 wrote to memory of 2504 4956 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe cmd.exe PID 4956 wrote to memory of 2504 4956 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe cmd.exe PID 4956 wrote to memory of 2504 4956 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe cmd.exe PID 2504 wrote to memory of 656 2504 cmd.exe reg.exe PID 2504 wrote to memory of 656 2504 cmd.exe reg.exe PID 2504 wrote to memory of 656 2504 cmd.exe reg.exe PID 4956 wrote to memory of 4604 4956 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Intel.exe PID 4956 wrote to memory of 4604 4956 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Intel.exe PID 4956 wrote to memory of 4604 4956 b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe Intel.exe PID 4604 wrote to memory of 4924 4604 Intel.exe Intel.exe PID 4604 wrote to memory of 4924 4604 Intel.exe Intel.exe PID 4604 wrote to memory of 4924 4604 Intel.exe Intel.exe PID 4604 wrote to memory of 4924 4604 Intel.exe Intel.exe PID 4604 wrote to memory of 4924 4604 Intel.exe Intel.exe PID 4604 wrote to memory of 4924 4604 Intel.exe Intel.exe PID 4604 wrote to memory of 4924 4604 Intel.exe Intel.exe PID 4604 wrote to memory of 4924 4604 Intel.exe Intel.exe PID 4604 wrote to memory of 1988 4604 Intel.exe REG.exe PID 4604 wrote to memory of 1988 4604 Intel.exe REG.exe PID 4604 wrote to memory of 1988 4604 Intel.exe REG.exe PID 4604 wrote to memory of 1332 4604 Intel.exe REG.exe PID 4604 wrote to memory of 1332 4604 Intel.exe REG.exe PID 4604 wrote to memory of 1332 4604 Intel.exe REG.exe PID 4604 wrote to memory of 4832 4604 Intel.exe REG.exe PID 4604 wrote to memory of 4832 4604 Intel.exe REG.exe PID 4604 wrote to memory of 4832 4604 Intel.exe REG.exe PID 4604 wrote to memory of 4368 4604 Intel.exe REG.exe PID 4604 wrote to memory of 4368 4604 Intel.exe REG.exe PID 4604 wrote to memory of 4368 4604 Intel.exe REG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe"C:\Users\Admin\AppData\Local\Temp\b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Intel" /t REG_SZ /d "C:\ProgramData\Intel.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Intel" /t REG_SZ /d "C:\ProgramData\Intel.exe"3⤵
- Adds Run key to start application
-
C:\ProgramData\Intel.exeC:\ProgramData\Intel.exe2⤵
- Executes dropped EXE
- Drops startup file
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Intel.exe"C:\ProgramData\Intel.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\REG.exeREG add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
- Disables RegEdit via registry modification
-
C:\Windows\SysWOW64\REG.exeREG add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\REG.exeREG add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\SysWOW64\REG.exeREG add HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Intel.exeFilesize
422KB
MD5554c3f24b05707d2b19bf38507598d76
SHA1d97f51df068df55952aa8c04262bebcad9854d11
SHA256b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725
SHA5127c7c952285de0f8c57c6a87abec26936dadc7abf5263b783c4ac6135d7a18f4dfa42fc05aaf5ad0b791f2e741016496e22201e751e532eb55a0f113fd92e9328
-
C:\ProgramData\Intel.exeFilesize
422KB
MD5554c3f24b05707d2b19bf38507598d76
SHA1d97f51df068df55952aa8c04262bebcad9854d11
SHA256b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725
SHA5127c7c952285de0f8c57c6a87abec26936dadc7abf5263b783c4ac6135d7a18f4dfa42fc05aaf5ad0b791f2e741016496e22201e751e532eb55a0f113fd92e9328
-
C:\ProgramData\Intel.exeFilesize
422KB
MD5554c3f24b05707d2b19bf38507598d76
SHA1d97f51df068df55952aa8c04262bebcad9854d11
SHA256b62fac0d96da7a95beed52c8fea432ab3308fd714209cf50f1123867a4e03725
SHA5127c7c952285de0f8c57c6a87abec26936dadc7abf5263b783c4ac6135d7a18f4dfa42fc05aaf5ad0b791f2e741016496e22201e751e532eb55a0f113fd92e9328
-
memory/656-135-0x0000000000000000-mapping.dmp
-
memory/1332-145-0x0000000000000000-mapping.dmp
-
memory/1988-144-0x0000000000000000-mapping.dmp
-
memory/2504-134-0x0000000000000000-mapping.dmp
-
memory/4368-147-0x0000000000000000-mapping.dmp
-
memory/4604-136-0x0000000000000000-mapping.dmp
-
memory/4604-148-0x0000000074F90000-0x0000000075541000-memory.dmpFilesize
5.7MB
-
memory/4604-149-0x0000000074F90000-0x0000000075541000-memory.dmpFilesize
5.7MB
-
memory/4832-146-0x0000000000000000-mapping.dmp
-
memory/4924-140-0x0000000000000000-mapping.dmp
-
memory/4924-143-0x0000000000700000-0x0000000000717000-memory.dmpFilesize
92KB
-
memory/4956-139-0x0000000074F90000-0x0000000075541000-memory.dmpFilesize
5.7MB
-
memory/4956-133-0x0000000074F90000-0x0000000075541000-memory.dmpFilesize
5.7MB
-
memory/4956-132-0x0000000074F90000-0x0000000075541000-memory.dmpFilesize
5.7MB