Analysis
-
max time kernel
91s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 04:26
Static task
static1
Behavioral task
behavioral1
Sample
e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe
Resource
win10v2004-20220901-en
General
-
Target
e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe
-
Size
796KB
-
MD5
09f787f7bfa486df17725c9c4eb251ce
-
SHA1
b1b5778c732f8d319f2096abeba7175020ad9123
-
SHA256
e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c
-
SHA512
1f9d432e0dcf8f02b15909ce5fc9197647e5abcf2537680e3d5794d740b98c8793aa386c5e305e11b2e550a69158a1ece312fd178d72eec766c1df56b4cd383c
-
SSDEEP
6144:9eb/LfqouTcCFLgAg3PxNKXYgBdnaNT2b3cpMN/XFjAn5N0GdJbU54ql0q/37//3:MAcCaZL0YCgsyMN/XFEnzZU4q0c3
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\janta\\jannta.exe" e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe -
Executes dropped EXE 2 IoCs
Processes:
tmp.exe .exepid process 2576 tmp.exe 1504 .exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exewscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation wscript.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exedescription pid process target process PID 384 set thread context of 1504 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4692 1504 WerFault.exe .exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exepid process 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exedescription pid process Token: SeDebugPrivilege 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe Token: 33 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe Token: SeIncBasePriorityPrivilege 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.execmd.exewscript.exedescription pid process target process PID 384 wrote to memory of 3604 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe cmd.exe PID 384 wrote to memory of 3604 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe cmd.exe PID 384 wrote to memory of 3604 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe cmd.exe PID 3604 wrote to memory of 5020 3604 cmd.exe wscript.exe PID 3604 wrote to memory of 5020 3604 cmd.exe wscript.exe PID 3604 wrote to memory of 5020 3604 cmd.exe wscript.exe PID 384 wrote to memory of 2576 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe tmp.exe PID 384 wrote to memory of 2576 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe tmp.exe PID 384 wrote to memory of 2576 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe tmp.exe PID 5020 wrote to memory of 3056 5020 wscript.exe cmd.exe PID 5020 wrote to memory of 3056 5020 wscript.exe cmd.exe PID 5020 wrote to memory of 3056 5020 wscript.exe cmd.exe PID 384 wrote to memory of 1504 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe .exe PID 384 wrote to memory of 1504 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe .exe PID 384 wrote to memory of 1504 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe .exe PID 384 wrote to memory of 1504 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe .exe PID 384 wrote to memory of 1504 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe .exe PID 384 wrote to memory of 1504 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe .exe PID 384 wrote to memory of 1504 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe .exe PID 384 wrote to memory of 1504 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe .exe PID 384 wrote to memory of 3440 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe cmd.exe PID 384 wrote to memory of 3440 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe cmd.exe PID 384 wrote to memory of 3440 384 e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe"C:\Users\Admin\AppData\Local\Temp\e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\janta\mata.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\janta\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\janta\mata2.bat3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\janta\mata2.bat" "4⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\ .exe"C:\Users\Admin\AppData\Local\Temp\ .exe"2⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 5043⤵
- Program crash
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\janta\melt.bat2⤵PID:3440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 15041⤵PID:2072
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ .exeFilesize
57KB
MD5454501a66ad6e85175a6757573d79f8b
SHA18ca96c61f26a640a5b1b1152d055260b9d43e308
SHA2567fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
SHA5129dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7
-
C:\Users\Admin\AppData\Local\Temp\ .exeFilesize
57KB
MD5454501a66ad6e85175a6757573d79f8b
SHA18ca96c61f26a640a5b1b1152d055260b9d43e308
SHA2567fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
SHA5129dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7
-
C:\Users\Admin\AppData\Local\Temp\janta\invs.vbsFilesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
C:\Users\Admin\AppData\Local\Temp\janta\jannta.exeFilesize
796KB
MD509f787f7bfa486df17725c9c4eb251ce
SHA1b1b5778c732f8d319f2096abeba7175020ad9123
SHA256e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c
SHA5121f9d432e0dcf8f02b15909ce5fc9197647e5abcf2537680e3d5794d740b98c8793aa386c5e305e11b2e550a69158a1ece312fd178d72eec766c1df56b4cd383c
-
C:\Users\Admin\AppData\Local\Temp\janta\mata.batFilesize
59B
MD5844e5e81fb960cdeff29d07e6e20f528
SHA18c33d7f1c58c4dbce851f4ad91daed63183def8a
SHA256396396d747c61f9ef01b4807e54839bda9d54006b2f2795053857f753cb15825
SHA51291d226f3116bba099e9937fa8a8ad1605775e59c4b22c9b97c0717b1e90044af2c2183850c53e346ba19f53863cc44a355fbbf1b72e03ddd27c4f7851e3c84a6
-
C:\Users\Admin\AppData\Local\Temp\janta\mata2.batFilesize
63B
MD536cbe64458aa7fbfc672aaf0b672db7a
SHA1af5485568a53b27caebb4a9ea75bec1911d16013
SHA256e1ca8e58618daa36b919897edd46de523f5bd81a1caa339830d56d02c818a3d6
SHA51225b7b80826edbfa60e302a2744461e48cd145e949aa0b1688389904e43190cd78a6765631a1e5343c8aeb0e4759e5de921a8cb571f8a5f10d247df7f1d68eded
-
C:\Users\Admin\AppData\Local\Temp\janta\rundll11-.txtFilesize
796KB
MD509f787f7bfa486df17725c9c4eb251ce
SHA1b1b5778c732f8d319f2096abeba7175020ad9123
SHA256e26ca8248c612dd9d046a4e0c32d195a701c9fbcac0dd3638537165a7d3fdb9c
SHA5121f9d432e0dcf8f02b15909ce5fc9197647e5abcf2537680e3d5794d740b98c8793aa386c5e305e11b2e550a69158a1ece312fd178d72eec766c1df56b4cd383c
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
161KB
MD55978bf5669cd1d06d81decb80b21157b
SHA1c2f6b9feff435166c1740185481b3b9ad21ee5d0
SHA256bd50b08281c4796737874a2c437ba0deaf106e541771fc070c218915db7e2915
SHA512afaa8d9715b331c112bce0c8c045637697970fe9ae0d67e53a0ef7d9aa2a1e098c78bed068f12f7d02e01271c3c58562ac7fb65e9605c61d85bc4856d4e0d0e4
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
161KB
MD55978bf5669cd1d06d81decb80b21157b
SHA1c2f6b9feff435166c1740185481b3b9ad21ee5d0
SHA256bd50b08281c4796737874a2c437ba0deaf106e541771fc070c218915db7e2915
SHA512afaa8d9715b331c112bce0c8c045637697970fe9ae0d67e53a0ef7d9aa2a1e098c78bed068f12f7d02e01271c3c58562ac7fb65e9605c61d85bc4856d4e0d0e4
-
memory/384-144-0x00000000754F0000-0x0000000075AA1000-memory.dmpFilesize
5.7MB
-
memory/384-132-0x00000000754F0000-0x0000000075AA1000-memory.dmpFilesize
5.7MB
-
memory/384-153-0x00000000754F0000-0x0000000075AA1000-memory.dmpFilesize
5.7MB
-
memory/1504-142-0x0000000000000000-mapping.dmp
-
memory/1504-145-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1504-149-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2576-138-0x0000000000000000-mapping.dmp
-
memory/3056-139-0x0000000000000000-mapping.dmp
-
memory/3440-152-0x0000000000000000-mapping.dmp
-
memory/3604-133-0x0000000000000000-mapping.dmp
-
memory/5020-135-0x0000000000000000-mapping.dmp