Analysis
-
max time kernel
163s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 12:51
Static task
static1
Behavioral task
behavioral1
Sample
75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
Resource
win10v2004-20220812-en
General
-
Target
75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
-
Size
97KB
-
MD5
5383675e7dee2bad06115abaa5a59b4b
-
SHA1
5350db1e955b919d3e220cc37c48fb58a8e7b6ab
-
SHA256
75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9
-
SHA512
e7ac2e7693620321db0a1f7c984f0d874a064978e6ea609bccd52209eab49d593b9ac77bfa174d813f4871e00bb2565a7c471d8fde6ecaeaad782b146a4edbfd
-
SSDEEP
1536:MZpgvMIvRvwHMWhY7ZXaXJyi5aVwCDOA7yEYkeZ3p4wZJKvcXO:MnbI5vwHMWhYwJyi5wwC35QT4mXO
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\SunJava\\JavaUpdata.exe" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exedescription pid process target process PID 2872 set thread context of 4244 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exepid process 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exedescription pid process Token: SeDebugPrivilege 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe Token: SeDebugPrivilege 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe Token: SeShutdownPrivilege 4244 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.execmd.exedescription pid process target process PID 2872 wrote to memory of 5088 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 5088 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 5088 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 5048 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 5048 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 5048 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 5096 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 5096 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 5096 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 4244 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 4244 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 4244 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 4244 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 4244 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 4244 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 4244 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 4244 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 4244 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 4244 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe PID 2872 wrote to memory of 3152 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe cmd.exe PID 2872 wrote to memory of 3152 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe cmd.exe PID 2872 wrote to memory of 3152 2872 75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe cmd.exe PID 3152 wrote to memory of 2036 3152 cmd.exe reg.exe PID 3152 wrote to memory of 2036 3152 cmd.exe reg.exe PID 3152 wrote to memory of 2036 3152 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"2⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"2⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"2⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"C:\Users\Admin\AppData\Roaming\SunJava\JavaUpdata.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"C:\Users\Admin\AppData\Roaming\SunJava\JavaUpdata.exe"3⤵
- Modifies WinLogon for persistence
PID:2036