Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 18:00
Static task
static1
Behavioral task
behavioral1
Sample
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe
Resource
win10v2004-20220901-en
General
-
Target
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe
-
Size
1.7MB
-
MD5
25608c802cc888e22266120f327032fd
-
SHA1
164717002d508e77a9131b4fd8828e93167886d7
-
SHA256
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c
-
SHA512
0cebd8c895748ae7392f73ab3e0c37eb38bd1bc2973294adf3f3c71595e772a3d8054d6ba9f82382283a6a010e33fd7b72a730ee4b4e4a574a7e47fe3dc4821c
-
SSDEEP
49152:PD1YJREKyzVULk4FdtIYTAdZTCbMklbm:5Yz/yatFdtI3ZTCb
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
IpOverUsbSvrc.exeatiesrx.exepid process 4248 IpOverUsbSvrc.exe 1944 atiesrx.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exeWScript.exeIpOverUsbSvrc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation IpOverUsbSvrc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
IpOverUsbSvrc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe" IpOverUsbSvrc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 myip.dnsomatic.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exeatiesrx.exedescription pid process target process PID 4284 set thread context of 4188 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1944 set thread context of 4520 1944 atiesrx.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exevbc.exepid process 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4188 vbc.exe 4188 vbc.exe 4188 vbc.exe 4188 vbc.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exeIpOverUsbSvrc.exeatiesrx.exedescription pid process Token: SeDebugPrivilege 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe Token: SeDebugPrivilege 4248 IpOverUsbSvrc.exe Token: SeDebugPrivilege 1944 atiesrx.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exevbc.exeWScript.execmd.exeIpOverUsbSvrc.exeatiesrx.exedescription pid process target process PID 4284 wrote to memory of 4188 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 4284 wrote to memory of 4188 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 4284 wrote to memory of 4188 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 4284 wrote to memory of 4188 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 4284 wrote to memory of 4188 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 4284 wrote to memory of 4188 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 4284 wrote to memory of 4188 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 4284 wrote to memory of 4188 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 4284 wrote to memory of 4188 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 4284 wrote to memory of 4188 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 4284 wrote to memory of 4248 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe IpOverUsbSvrc.exe PID 4284 wrote to memory of 4248 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe IpOverUsbSvrc.exe PID 4284 wrote to memory of 4248 4284 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe IpOverUsbSvrc.exe PID 4188 wrote to memory of 4372 4188 vbc.exe WScript.exe PID 4188 wrote to memory of 4372 4188 vbc.exe WScript.exe PID 4188 wrote to memory of 4372 4188 vbc.exe WScript.exe PID 4372 wrote to memory of 3432 4372 WScript.exe cmd.exe PID 4372 wrote to memory of 3432 4372 WScript.exe cmd.exe PID 4372 wrote to memory of 3432 4372 WScript.exe cmd.exe PID 3432 wrote to memory of 2844 3432 cmd.exe attrib.exe PID 3432 wrote to memory of 2844 3432 cmd.exe attrib.exe PID 3432 wrote to memory of 2844 3432 cmd.exe attrib.exe PID 4248 wrote to memory of 1944 4248 IpOverUsbSvrc.exe atiesrx.exe PID 4248 wrote to memory of 1944 4248 IpOverUsbSvrc.exe atiesrx.exe PID 4248 wrote to memory of 1944 4248 IpOverUsbSvrc.exe atiesrx.exe PID 1944 wrote to memory of 4520 1944 atiesrx.exe vbc.exe PID 1944 wrote to memory of 4520 1944 atiesrx.exe vbc.exe PID 1944 wrote to memory of 4520 1944 atiesrx.exe vbc.exe PID 1944 wrote to memory of 4520 1944 atiesrx.exe vbc.exe PID 1944 wrote to memory of 4520 1944 atiesrx.exe vbc.exe PID 1944 wrote to memory of 4520 1944 atiesrx.exe vbc.exe PID 1944 wrote to memory of 4520 1944 atiesrx.exe vbc.exe PID 1944 wrote to memory of 4520 1944 atiesrx.exe vbc.exe PID 1944 wrote to memory of 4520 1944 atiesrx.exe vbc.exe PID 1944 wrote to memory of 4520 1944 atiesrx.exe vbc.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe"C:\Users\Admin\AppData\Local\Temp\e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\RealNetowrks5⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exeFilesize
11KB
MD55249a17cb09bb8d857feb19c047a894b
SHA1c9e8a8f6cf2d4f14c68b85f409a2d50a57114c79
SHA25679c10fbcc5f86767857e5193096dcb866dff14e039da6bfa07c7cbd9095b99f1
SHA51256bfecdc10e0d5e89a9fad91a033fe7f81c673e1167cd994fd5f57c126c02563d18d734713da82d3e30e47201920e49059ff169d0ba486d8be835688e0856d23
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exeFilesize
11KB
MD55249a17cb09bb8d857feb19c047a894b
SHA1c9e8a8f6cf2d4f14c68b85f409a2d50a57114c79
SHA25679c10fbcc5f86767857e5193096dcb866dff14e039da6bfa07c7cbd9095b99f1
SHA51256bfecdc10e0d5e89a9fad91a033fe7f81c673e1167cd994fd5f57c126c02563d18d734713da82d3e30e47201920e49059ff169d0ba486d8be835688e0856d23
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeFilesize
1.7MB
MD525608c802cc888e22266120f327032fd
SHA1164717002d508e77a9131b4fd8828e93167886d7
SHA256e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c
SHA5120cebd8c895748ae7392f73ab3e0c37eb38bd1bc2973294adf3f3c71595e772a3d8054d6ba9f82382283a6a010e33fd7b72a730ee4b4e4a574a7e47fe3dc4821c
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeFilesize
1.7MB
MD525608c802cc888e22266120f327032fd
SHA1164717002d508e77a9131b4fd8828e93167886d7
SHA256e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c
SHA5120cebd8c895748ae7392f73ab3e0c37eb38bd1bc2973294adf3f3c71595e772a3d8054d6ba9f82382283a6a010e33fd7b72a730ee4b4e4a574a7e47fe3dc4821c
-
C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.batFilesize
56B
MD54a55a5a5ca857637659220aeb1a91d92
SHA14c73b21f348ed194dec47bcb0c3a83071be864e8
SHA2560aa9d5a6e2d224e57d44bd4267c6d98479e25b052c878e579cc5d2facbcc601f
SHA512d7ea2948e2c5f60675c08d6a8308cd7c449e1efaef818a24bf0481b8f5a45412a04b5fd580035127bcd052cc754fb948dc947989528ee9a52ce64457ab2eac51
-
C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.vbsFilesize
169B
MD53d987aec0fa7269c334d9d52676f7ae6
SHA1c912e179bfcad6b0d10061cfe4eb84bfa069a5f5
SHA256757a187de0343591d7d49a2fa71ef8a8f8325f61df8f2bff905c36d599bdd549
SHA5128ff828024cfdb0db4bc0474ce4b5f00e691c0d9c4193ebd67bb57b4ba7907690e688c6c0a78863a8ece6e244ef21e89c0aa1b7f073146fad0a2b0e59beb58e63
-
memory/1944-153-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/1944-154-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/1944-151-0x0000000000000000-mapping.dmp
-
memory/2844-147-0x0000000000000000-mapping.dmp
-
memory/3432-146-0x0000000000000000-mapping.dmp
-
memory/4188-136-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/4188-135-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/4188-141-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/4188-148-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/4188-134-0x0000000000000000-mapping.dmp
-
memory/4188-137-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/4248-138-0x0000000000000000-mapping.dmp
-
memory/4248-142-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/4248-149-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/4284-133-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/4284-132-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/4284-155-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/4372-143-0x0000000000000000-mapping.dmp
-
memory/4520-156-0x0000000000000000-mapping.dmp
-
memory/4520-158-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/4520-159-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/4520-160-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB