Analysis
-
max time kernel
152s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:27
Static task
static1
Behavioral task
behavioral1
Sample
91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exe
Resource
win10v2004-20220812-en
General
-
Target
91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exe
-
Size
384KB
-
MD5
22db5e69b1c46eda11681b649d150477
-
SHA1
494a86694800dab92006d9a406f80b3781587890
-
SHA256
91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab
-
SHA512
00fa8a9e5eeea3492f57bbf2fdba01d972633278b26f50d01a8f27b2d2f0d0e5152d398a518480268e7cfe8557cac587a87c3195326c55fdcf409174b153971b
-
SSDEEP
6144:CEF3VpTPqTFp0hyA401oa+MVrXgEClb/Z+nUfy6dxRytD0HfO2N0i:X3Vp7eChaG4lbBrlx40HL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
sesteml.exepid process 1804 sesteml.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exesesteml.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Download grand theft auto san andreas.exe" 91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Download grand theft auto san andreas.exe" sesteml.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1e0c24a5d9e94357e324f2da05a893d3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sesteml.exe\" .." sesteml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1e0c24a5d9e94357e324f2da05a893d3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sesteml.exe\" .." sesteml.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
sesteml.exepid process 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe 1804 sesteml.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
sesteml.exedescription pid process Token: SeDebugPrivilege 1804 sesteml.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exesesteml.exedescription pid process target process PID 1760 wrote to memory of 1804 1760 91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exe sesteml.exe PID 1760 wrote to memory of 1804 1760 91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exe sesteml.exe PID 1804 wrote to memory of 1352 1804 sesteml.exe netsh.exe PID 1804 wrote to memory of 1352 1804 sesteml.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exe"C:\Users\Admin\AppData\Local\Temp\91e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\sesteml.exe"C:\Users\Admin\AppData\Local\Temp\sesteml.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\sesteml.exe" "sesteml.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1352
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sesteml.exeFilesize
384KB
MD522db5e69b1c46eda11681b649d150477
SHA1494a86694800dab92006d9a406f80b3781587890
SHA25691e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab
SHA51200fa8a9e5eeea3492f57bbf2fdba01d972633278b26f50d01a8f27b2d2f0d0e5152d398a518480268e7cfe8557cac587a87c3195326c55fdcf409174b153971b
-
C:\Users\Admin\AppData\Local\Temp\sesteml.exeFilesize
384KB
MD522db5e69b1c46eda11681b649d150477
SHA1494a86694800dab92006d9a406f80b3781587890
SHA25691e6640a2c9f97db51f4507973f1269a385e66bba1a8c83cd3252f623e899cab
SHA51200fa8a9e5eeea3492f57bbf2fdba01d972633278b26f50d01a8f27b2d2f0d0e5152d398a518480268e7cfe8557cac587a87c3195326c55fdcf409174b153971b
-
memory/1352-137-0x0000000000000000-mapping.dmp
-
memory/1760-132-0x00007FFA6CBF0000-0x00007FFA6D626000-memory.dmpFilesize
10.2MB
-
memory/1804-133-0x0000000000000000-mapping.dmp
-
memory/1804-136-0x00007FFA6CBF0000-0x00007FFA6D626000-memory.dmpFilesize
10.2MB