33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667

Analysis

max time kernel
184s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exe
Size

983KB
MD5

13594cc201f9fe3cc25c08fbd75b6192
SHA1

c1844f7f46ab35e76e82b371c8e1eba5a749ea8a
SHA256

33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667
SHA512

ffeb469f4e0bab30cf24126d576563771169f49b37df15cba4a27243ddc9dfd262c672b6dffb2cd103e2c5ed7bf264cf5550117548460a4b5661794ec3933a31
SSDEEP

1536:cd04boUzdIBsZUpUQSe1sjL/91IqmM4nouy8:cdJboUpEsueFssP11I5Mwout

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

winlogon.exe

pid process

116 winlogon.exe

pid	process
116	winlogon.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1612-132-0x0000000000400000-0x0000000000447000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/1612-138-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral2/memory/116-141-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral2/memory/116-142-0x0000000000400000-0x0000000000447000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exewinlogon.exe

pid process

1612 33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exe
116 winlogon.exe

pid	process
1612	33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exe
116	winlogon.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exe

description	pid	process	target process
PID 1612 wrote to memory of 116	1612	33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exe	winlogon.exe
PID 1612 wrote to memory of 116	1612	33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exe	winlogon.exe
PID 1612 wrote to memory of 116	1612	33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exe	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exe
"C:\Users\Admin\AppData\Local\Temp\33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:116

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\E696D64614\winlogon.exe
Filesize
983KB

MD5
13594cc201f9fe3cc25c08fbd75b6192

SHA1
c1844f7f46ab35e76e82b371c8e1eba5a749ea8a

SHA256
33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667

SHA512
ffeb469f4e0bab30cf24126d576563771169f49b37df15cba4a27243ddc9dfd262c672b6dffb2cd103e2c5ed7bf264cf5550117548460a4b5661794ec3933a31

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
983KB

MD5
13594cc201f9fe3cc25c08fbd75b6192

SHA1
c1844f7f46ab35e76e82b371c8e1eba5a749ea8a

SHA256
33720571befd5f3e12b781fa94833929d61253e2dc1ad05aece4a1bb4e598667

SHA512
ffeb469f4e0bab30cf24126d576563771169f49b37df15cba4a27243ddc9dfd262c672b6dffb2cd103e2c5ed7bf264cf5550117548460a4b5661794ec3933a31

Download Submit
memory/116-135-0x0000000000000000-mapping.dmp

Download
memory/116-141-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/116-142-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1612-132-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1612-138-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download