Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 22:24
Static task
static1
Behavioral task
behavioral1
Sample
2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
Resource
win10v2004-20220901-en
General
-
Target
2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe
-
Size
95KB
-
MD5
e8c4741eb950dc6e2936fbb82b69f20d
-
SHA1
6b4a143184b535f2dd8cdb439277817e297e92d1
-
SHA256
2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224
-
SHA512
1950080032605533bddbb65930140ffc30b6b7c0eecb4e080593fad00c72d8d84668a31790a85240bd9dac33cf7641e3c2eee12ed40ff73dcc8b94ac615233b8
-
SSDEEP
1536:V4UHxpN/MUXsLTvCj0DBXJaOvWHzw0reZBIN85ymPhJ58YMztlsIgzZUKaV/O:V4URpNUUX6z/DBXJfvWTw6IIN8xX58Zm
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\34525 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mseqlhmta.exe" svchost.exe -
Loads dropped DLL 2 IoCs
Processes:
2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exepid process 4180 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe 4180 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exedescription pid process target process PID 4180 set thread context of 2052 4180 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe -
Drops file in Program Files directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\PROGRA~3\LOCALS~1\Temp\mseqlhmta.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exepid process 2052 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe 2052 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exepid process 2052 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe 2052 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exedescription pid process target process PID 4180 wrote to memory of 2052 4180 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe PID 4180 wrote to memory of 2052 4180 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe PID 4180 wrote to memory of 2052 4180 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe PID 4180 wrote to memory of 2052 4180 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe PID 4180 wrote to memory of 2052 4180 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe PID 4180 wrote to memory of 2052 4180 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe PID 2052 wrote to memory of 3848 2052 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe svchost.exe PID 2052 wrote to memory of 3848 2052 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe svchost.exe PID 2052 wrote to memory of 3848 2052 2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe"C:\Users\Admin\AppData\Local\Temp\2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe"C:\Users\Admin\AppData\Local\Temp\2de41878725f3f6da01c770224bcc2580be15139334dc09020a17fbb2400e224.exe"2⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\syswow64\svchost.exe3⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
PID:3848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsoB80B.tmp\Tyndale.dllFilesize
67KB
MD5493cf0f265ea7e90bc3aab5daebed560
SHA11ae2744ea9f4698a14c7a3704b80e74ca3a0a198
SHA256814d634c09c0cac0b4d77395591ea1143028ce39b9f4fff3c38e1ac9f5518817
SHA512856e42602e5ecadfb89cf41390ad6615979c1aae8bb43a96587c8e8380c838f831820d364748448b6516d695f4005ec139b8571777ac472ba6c8ef4b44224e5e
-
C:\Users\Admin\AppData\Local\Temp\nsoB80B.tmp\Tyndale.dllFilesize
67KB
MD5493cf0f265ea7e90bc3aab5daebed560
SHA11ae2744ea9f4698a14c7a3704b80e74ca3a0a198
SHA256814d634c09c0cac0b4d77395591ea1143028ce39b9f4fff3c38e1ac9f5518817
SHA512856e42602e5ecadfb89cf41390ad6615979c1aae8bb43a96587c8e8380c838f831820d364748448b6516d695f4005ec139b8571777ac472ba6c8ef4b44224e5e
-
memory/2052-135-0x0000000000000000-mapping.dmp
-
memory/2052-136-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/3848-137-0x0000000000000000-mapping.dmp
-
memory/3848-138-0x00000000008D0000-0x00000000008DE000-memory.dmpFilesize
56KB
-
memory/3848-139-0x0000000001020000-0x0000000001025000-memory.dmpFilesize
20KB
-
memory/3848-140-0x0000000001020000-0x0000000001025000-memory.dmpFilesize
20KB
-
memory/4180-134-0x0000000002800000-0x000000000281A000-memory.dmpFilesize
104KB