Analysis

  • max time kernel
    179s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 19:11

General

  • Target

    file.exe

  • Size

    7.3MB

  • MD5

    fc2584e28d3a565d5787357b7e8b4f1d

  • SHA1

    df7aa1db56e6c92c5260440874ff286d4e4fabd0

  • SHA256

    da773e6f569c5c5b76ec58c61d1e30c7eda614e92929217d74377bb017e6d972

  • SHA512

    2da477731aaedb2e663fc6ed62cca867bf233d903d69985670d5598266b82b266bb8d20e27e74d028a36472a9b0225c2dc3b869aa62483e4ba5498650d52cbb6

  • SSDEEP

    196608:91OJAYQ8JX1ZiuVlta2EjcMNo2/tzycPN7lcpvvoDFyQbv:3OJAd8J1kWlc1No21z3l7EHoJLbv

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\7zSF83F.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4520
      • C:\Users\Admin\AppData\Local\Temp\7zS6060.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:2416
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3828
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4548
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:4532
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:4396
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2208
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1652
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:2280
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:3760
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gkOjvlmYE" /SC once /ST 08:11:04 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:4588
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gkOjvlmYE"
                  4⤵
                    PID:2120
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gkOjvlmYE"
                    4⤵
                      PID:3868
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bbsSMGQQDZvgelOgpL" /SC once /ST 20:15:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\VXAfcxyYiTQKMOERw\efplSHrLkKviaSK\KUdrePT.exe\" DC /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:1640
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1700
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:5092
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:4596
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:1572
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:3424

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Execution

                      Scheduled Task

                      1
                      T1053

                      Persistence

                      Scheduled Task

                      1
                      T1053

                      Privilege Escalation

                      Scheduled Task

                      1
                      T1053

                      Discovery

                      Query Registry

                      3
                      T1012

                      System Information Discovery

                      4
                      T1082

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\7zS6060.tmp\Install.exe
                        Filesize

                        6.8MB

                        MD5

                        893793fbd70ba4a92919d09205d6c9c1

                        SHA1

                        cb1832f1f9652faece655ffbf49d82feb98ca85a

                        SHA256

                        a240fda428ecca831c7730c83f40be6f43bb8370f33d8d66d4844b734011c57b

                        SHA512

                        e4e30918b96bd5b7d0b8bc6ac189b1ebad645b12e0ac3de061daa9e7003d6e746fee1c6d9cb637a7aa19543b3339c08dbdb1e35a78628e8764a07dedb3a73dc4

                      • C:\Users\Admin\AppData\Local\Temp\7zS6060.tmp\Install.exe
                        Filesize

                        6.8MB

                        MD5

                        893793fbd70ba4a92919d09205d6c9c1

                        SHA1

                        cb1832f1f9652faece655ffbf49d82feb98ca85a

                        SHA256

                        a240fda428ecca831c7730c83f40be6f43bb8370f33d8d66d4844b734011c57b

                        SHA512

                        e4e30918b96bd5b7d0b8bc6ac189b1ebad645b12e0ac3de061daa9e7003d6e746fee1c6d9cb637a7aa19543b3339c08dbdb1e35a78628e8764a07dedb3a73dc4

                      • C:\Users\Admin\AppData\Local\Temp\7zSF83F.tmp\Install.exe
                        Filesize

                        6.3MB

                        MD5

                        b7a2858c0b452218cb49839d0a9acbc1

                        SHA1

                        6af3be70f7ba92abe9a24561d3f8db1eb2c8834b

                        SHA256

                        529aa021ae449b2574f09baae8f298b1d647befcbd0dbcea4036b2f3c8db7104

                        SHA512

                        e8712076d86dbea94d3f7d8c5529e818dc07ceb6259548bbde2a70ad7c4fa16a241928ccaaa3993c6b18b6694fe79415d5efbfb7c9aaecb29ef661e0ccb17492

                      • C:\Users\Admin\AppData\Local\Temp\7zSF83F.tmp\Install.exe
                        Filesize

                        6.3MB

                        MD5

                        b7a2858c0b452218cb49839d0a9acbc1

                        SHA1

                        6af3be70f7ba92abe9a24561d3f8db1eb2c8834b

                        SHA256

                        529aa021ae449b2574f09baae8f298b1d647befcbd0dbcea4036b2f3c8db7104

                        SHA512

                        e8712076d86dbea94d3f7d8c5529e818dc07ceb6259548bbde2a70ad7c4fa16a241928ccaaa3993c6b18b6694fe79415d5efbfb7c9aaecb29ef661e0ccb17492

                      • memory/1640-156-0x0000000000000000-mapping.dmp
                      • memory/1652-144-0x0000000000000000-mapping.dmp
                      • memory/1700-154-0x00007FF811B00000-0x00007FF8125C1000-memory.dmp
                        Filesize

                        10.8MB

                      • memory/1700-153-0x00007FF811B00000-0x00007FF8125C1000-memory.dmp
                        Filesize

                        10.8MB

                      • memory/1700-151-0x00000142A28F0000-0x00000142A2912000-memory.dmp
                        Filesize

                        136KB

                      • memory/2120-150-0x0000000000000000-mapping.dmp
                      • memory/2208-142-0x0000000000000000-mapping.dmp
                      • memory/2280-146-0x0000000000000000-mapping.dmp
                      • memory/2416-138-0x0000000010000000-0x000000001119D000-memory.dmp
                        Filesize

                        17.6MB

                      • memory/2416-135-0x0000000000000000-mapping.dmp
                      • memory/3760-148-0x0000000000000000-mapping.dmp
                      • memory/3828-141-0x0000000000000000-mapping.dmp
                      • memory/3868-155-0x0000000000000000-mapping.dmp
                      • memory/4396-147-0x0000000000000000-mapping.dmp
                      • memory/4520-132-0x0000000000000000-mapping.dmp
                      • memory/4532-145-0x0000000000000000-mapping.dmp
                      • memory/4548-143-0x0000000000000000-mapping.dmp
                      • memory/4588-149-0x0000000000000000-mapping.dmp
                      • memory/5092-152-0x0000000000000000-mapping.dmp