Analysis
-
max time kernel
109s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 05:11
Static task
static1
Behavioral task
behavioral1
Sample
8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe
Resource
win10v2004-20220901-en
General
-
Target
8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe
-
Size
246KB
-
MD5
e49674d4e8d40e42a9ce4a80f5435718
-
SHA1
c32153d203baa003b8bb824fc254b27b48eaffa5
-
SHA256
8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32
-
SHA512
4c9afb978696717600e7354ccc7e0f1501c8882fc674203f6897f2abd364721b3f79aac46dc987cb06f9ebefa434106c0c2d1162446ea241ee1d3b38d4ee3b3d
-
SSDEEP
3072:x9DN6r8pitRYykcpxDXCf3KUdWwsZYibnqihXnz1/coipCRVEQpsvIXEd/9Ox16:tTEfTrZUdWws57qiZZBmyE7Ox16
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exepid process 4684 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe -
Processes:
resource yara_rule behavioral2/memory/1008-135-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1008-137-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1008-138-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1008-139-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1008-140-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1008-142-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1568-154-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1568-155-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1568-156-0x0000000000400000-0x0000000000453000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32 = "C:\\ProgramData\\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe" 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exedescription pid process target process PID 4284 set thread context of 1008 4284 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4684 set thread context of 1568 4684 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exepid process 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 1568 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exepid process 4284 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 4684 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.execmd.exe8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exedescription pid process target process PID 4284 wrote to memory of 1008 4284 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4284 wrote to memory of 1008 4284 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4284 wrote to memory of 1008 4284 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4284 wrote to memory of 1008 4284 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4284 wrote to memory of 1008 4284 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4284 wrote to memory of 1008 4284 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4284 wrote to memory of 1008 4284 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4284 wrote to memory of 1008 4284 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 1008 wrote to memory of 2788 1008 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe cmd.exe PID 1008 wrote to memory of 2788 1008 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe cmd.exe PID 1008 wrote to memory of 2788 1008 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe cmd.exe PID 2788 wrote to memory of 2152 2788 cmd.exe PING.EXE PID 2788 wrote to memory of 2152 2788 cmd.exe PING.EXE PID 2788 wrote to memory of 2152 2788 cmd.exe PING.EXE PID 2788 wrote to memory of 4684 2788 cmd.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 2788 wrote to memory of 4684 2788 cmd.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 2788 wrote to memory of 4684 2788 cmd.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4684 wrote to memory of 1568 4684 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4684 wrote to memory of 1568 4684 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4684 wrote to memory of 1568 4684 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4684 wrote to memory of 1568 4684 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4684 wrote to memory of 1568 4684 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4684 wrote to memory of 1568 4684 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4684 wrote to memory of 1568 4684 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe PID 4684 wrote to memory of 1568 4684 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe 8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe"C:\Users\Admin\AppData\Local\Temp\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe"C:\Users\Admin\AppData\Local\Temp\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 1 localhost4⤵
- Runs ping.exe
-
C:\ProgramData\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe"C:\ProgramData\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe"C:\ProgramData\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.batFilesize
460B
MD5ea0995a14602f4c8f52bb177ca50f270
SHA1866dfe3e0e935dfacb2fdf4184259e70b2a2d359
SHA256edc89087052dec28fda5774da073b9c6c9019a191aa907b4461234e2e552cfde
SHA5123c3e1c75d09084a42687e7dcd73c45e670581101506565e7744353cbbe02fa224850f709abdf379ec989a2f6b8356bd1fcc191ef52edc2681c87f002e2688745
-
C:\ProgramData\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exeFilesize
246KB
MD5e49674d4e8d40e42a9ce4a80f5435718
SHA1c32153d203baa003b8bb824fc254b27b48eaffa5
SHA2568f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32
SHA5124c9afb978696717600e7354ccc7e0f1501c8882fc674203f6897f2abd364721b3f79aac46dc987cb06f9ebefa434106c0c2d1162446ea241ee1d3b38d4ee3b3d
-
C:\ProgramData\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exeFilesize
246KB
MD5e49674d4e8d40e42a9ce4a80f5435718
SHA1c32153d203baa003b8bb824fc254b27b48eaffa5
SHA2568f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32
SHA5124c9afb978696717600e7354ccc7e0f1501c8882fc674203f6897f2abd364721b3f79aac46dc987cb06f9ebefa434106c0c2d1162446ea241ee1d3b38d4ee3b3d
-
C:\ProgramData\8f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32.exeFilesize
246KB
MD5e49674d4e8d40e42a9ce4a80f5435718
SHA1c32153d203baa003b8bb824fc254b27b48eaffa5
SHA2568f256b9b3807fd53c905636d61c276872d3703bb53675b437bead4178554db32
SHA5124c9afb978696717600e7354ccc7e0f1501c8882fc674203f6897f2abd364721b3f79aac46dc987cb06f9ebefa434106c0c2d1162446ea241ee1d3b38d4ee3b3d
-
memory/1008-139-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1008-140-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1008-142-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1008-137-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1008-138-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1008-135-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1008-134-0x0000000000000000-mapping.dmp
-
memory/1568-154-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1568-156-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1568-155-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1568-150-0x0000000000000000-mapping.dmp
-
memory/2152-144-0x0000000000000000-mapping.dmp
-
memory/2788-141-0x0000000000000000-mapping.dmp
-
memory/4684-145-0x0000000000000000-mapping.dmp