Analysis
-
max time kernel
163s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:48
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
1.3MB
-
MD5
442068a8271d880244a03d4d290c75fa
-
SHA1
bc20dc9ca257c6a0573d521e702cbf0369fdd4b3
-
SHA256
f34fab44d1f6f3db482c87cf464a86ed6813805953403425658446990a8a2daf
-
SHA512
a2a17a6b653087200be8b3ca5cfc80fe4db087c4fc57214090326948622e48fe0afeaea7c63a955099501ed6dec3b87328822e398cced151a7d8fc78e5a25f34
-
SSDEEP
24576:YmK6Q9qEYTewpekHZySOVhP8BCaff7XFf7aiJRw+UjxF:YmK6OqEYT1pek0VFof7ValxxF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
OWT.exepid process 2956 OWT.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
OWT.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation OWT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2092 timeout.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
file.exepowershell.exeOWT.exepowershell.exepid process 4604 file.exe 4604 file.exe 4552 powershell.exe 4552 powershell.exe 2956 OWT.exe 2956 OWT.exe 4488 powershell.exe 4488 powershell.exe 2956 OWT.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
file.exepowershell.exeOWT.exepowershell.exedescription pid process Token: SeDebugPrivilege 4604 file.exe Token: SeDebugPrivilege 4552 powershell.exe Token: SeDebugPrivilege 2956 OWT.exe Token: SeDebugPrivilege 4488 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
file.execmd.exeOWT.execmd.exedescription pid process target process PID 4604 wrote to memory of 4552 4604 file.exe powershell.exe PID 4604 wrote to memory of 4552 4604 file.exe powershell.exe PID 4604 wrote to memory of 4172 4604 file.exe cmd.exe PID 4604 wrote to memory of 4172 4604 file.exe cmd.exe PID 4172 wrote to memory of 2092 4172 cmd.exe timeout.exe PID 4172 wrote to memory of 2092 4172 cmd.exe timeout.exe PID 4172 wrote to memory of 2956 4172 cmd.exe OWT.exe PID 4172 wrote to memory of 2956 4172 cmd.exe OWT.exe PID 2956 wrote to memory of 4488 2956 OWT.exe powershell.exe PID 2956 wrote to memory of 4488 2956 OWT.exe powershell.exe PID 2956 wrote to memory of 4028 2956 OWT.exe cmd.exe PID 2956 wrote to memory of 4028 2956 OWT.exe cmd.exe PID 4028 wrote to memory of 3116 4028 cmd.exe schtasks.exe PID 4028 wrote to memory of 3116 4028 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1A6.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\ProgramData\winrar\OWT.exe"C:\ProgramData\winrar\OWT.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"5⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\winrar\OWT.exeFilesize
1.3MB
MD5442068a8271d880244a03d4d290c75fa
SHA1bc20dc9ca257c6a0573d521e702cbf0369fdd4b3
SHA256f34fab44d1f6f3db482c87cf464a86ed6813805953403425658446990a8a2daf
SHA512a2a17a6b653087200be8b3ca5cfc80fe4db087c4fc57214090326948622e48fe0afeaea7c63a955099501ed6dec3b87328822e398cced151a7d8fc78e5a25f34
-
C:\ProgramData\winrar\OWT.exeFilesize
1.3MB
MD5442068a8271d880244a03d4d290c75fa
SHA1bc20dc9ca257c6a0573d521e702cbf0369fdd4b3
SHA256f34fab44d1f6f3db482c87cf464a86ed6813805953403425658446990a8a2daf
SHA512a2a17a6b653087200be8b3ca5cfc80fe4db087c4fc57214090326948622e48fe0afeaea7c63a955099501ed6dec3b87328822e398cced151a7d8fc78e5a25f34
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Temp\tmp1A6.tmp.batFilesize
137B
MD5074545e9609c818e37efe0a21ae700a1
SHA170a132069f1bad451a387ef6b26cf462595ff4d8
SHA2567f1d7e44138750f62e453a86b017136da25aad57a4ec07c165d3b78fe806057e
SHA5123700b8427165e44c54b64dc81262857cb08cff0f93317c98940769a295a572d073415411941f5de6b2d66dfdf7faa38ab056f02be108129766b8f46c195fcb3e
-
memory/2092-153-0x0000000000000000-mapping.dmp
-
memory/2956-172-0x00007FFA49A70000-0x00007FFA4A531000-memory.dmpFilesize
10.8MB
-
memory/2956-169-0x00000000006D0000-0x000000000088C000-memory.dmpFilesize
1.7MB
-
memory/2956-187-0x00007FFA49A70000-0x00007FFA4A531000-memory.dmpFilesize
10.8MB
-
memory/2956-186-0x00000000006D0000-0x000000000088C000-memory.dmpFilesize
1.7MB
-
memory/2956-185-0x00007FFA49A70000-0x00007FFA4A531000-memory.dmpFilesize
10.8MB
-
memory/2956-184-0x0000000002CE0000-0x0000000002D23000-memory.dmpFilesize
268KB
-
memory/2956-183-0x00000000006D0000-0x000000000088C000-memory.dmpFilesize
1.7MB
-
memory/2956-182-0x00007FFA65920000-0x00007FFA6595B000-memory.dmpFilesize
236KB
-
memory/2956-167-0x00007FFA49A70000-0x00007FFA4A531000-memory.dmpFilesize
10.8MB
-
memory/2956-181-0x00007FFA67D30000-0x00007FFA67D9B000-memory.dmpFilesize
428KB
-
memory/2956-180-0x00007FFA452A0000-0x00007FFA453A2000-memory.dmpFilesize
1.0MB
-
memory/2956-179-0x00007FFA5A480000-0x00007FFA5A4B5000-memory.dmpFilesize
212KB
-
memory/2956-178-0x00007FFA66D10000-0x00007FFA66D37000-memory.dmpFilesize
156KB
-
memory/2956-164-0x0000000002CE0000-0x0000000002D23000-memory.dmpFilesize
268KB
-
memory/2956-165-0x00007FFA5A4C0000-0x00007FFA5A57D000-memory.dmpFilesize
756KB
-
memory/2956-166-0x00007FFA685C0000-0x00007FFA68761000-memory.dmpFilesize
1.6MB
-
memory/2956-162-0x00007FFA64470000-0x00007FFA64482000-memory.dmpFilesize
72KB
-
memory/2956-156-0x0000000000000000-mapping.dmp
-
memory/2956-170-0x00007FFA48320000-0x00007FFA4846E000-memory.dmpFilesize
1.3MB
-
memory/2956-168-0x00007FFA68350000-0x00007FFA6837B000-memory.dmpFilesize
172KB
-
memory/2956-160-0x00007FFA5A5A0000-0x00007FFA5A64A000-memory.dmpFilesize
680KB
-
memory/2956-161-0x00007FFA682B0000-0x00007FFA6834E000-memory.dmpFilesize
632KB
-
memory/2956-163-0x00000000006D0000-0x000000000088C000-memory.dmpFilesize
1.7MB
-
memory/3116-176-0x0000000000000000-mapping.dmp
-
memory/4028-174-0x0000000000000000-mapping.dmp
-
memory/4172-147-0x0000000000000000-mapping.dmp
-
memory/4488-171-0x0000000000000000-mapping.dmp
-
memory/4488-177-0x00007FFA49A70000-0x00007FFA4A531000-memory.dmpFilesize
10.8MB
-
memory/4552-151-0x0000022E9F460000-0x0000022E9F482000-memory.dmpFilesize
136KB
-
memory/4552-154-0x00007FFA49A70000-0x00007FFA4A531000-memory.dmpFilesize
10.8MB
-
memory/4552-146-0x0000000000000000-mapping.dmp
-
memory/4552-155-0x00007FFA49A70000-0x00007FFA4A531000-memory.dmpFilesize
10.8MB
-
memory/4604-140-0x00000000033F0000-0x0000000003433000-memory.dmpFilesize
268KB
-
memory/4604-150-0x00007FFA49A70000-0x00007FFA4A531000-memory.dmpFilesize
10.8MB
-
memory/4604-135-0x00007FFA64470000-0x00007FFA64482000-memory.dmpFilesize
72KB
-
memory/4604-134-0x00007FFA682B0000-0x00007FFA6834E000-memory.dmpFilesize
632KB
-
memory/4604-139-0x0000000000D30000-0x0000000000EEC000-memory.dmpFilesize
1.7MB
-
memory/4604-136-0x00007FFA499B0000-0x00007FFA49A6D000-memory.dmpFilesize
756KB
-
memory/4604-138-0x00007FFA49A70000-0x00007FFA4A531000-memory.dmpFilesize
10.8MB
-
memory/4604-133-0x00007FFA4A580000-0x00007FFA4A62A000-memory.dmpFilesize
680KB
-
memory/4604-148-0x0000000000D30000-0x0000000000EEC000-memory.dmpFilesize
1.7MB
-
memory/4604-149-0x00000000033F0000-0x0000000003433000-memory.dmpFilesize
268KB
-
memory/4604-137-0x00007FFA685C0000-0x00007FFA68761000-memory.dmpFilesize
1.6MB
-
memory/4604-145-0x00007FFA49A70000-0x00007FFA4A531000-memory.dmpFilesize
10.8MB
-
memory/4604-144-0x00007FFA48260000-0x00007FFA483AE000-memory.dmpFilesize
1.3MB
-
memory/4604-143-0x0000000000D30000-0x0000000000EEC000-memory.dmpFilesize
1.7MB
-
memory/4604-141-0x00007FFA68350000-0x00007FFA6837B000-memory.dmpFilesize
172KB
-
memory/4604-142-0x0000000000D30000-0x0000000000EEC000-memory.dmpFilesize
1.7MB