Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:33
Static task
static1
Behavioral task
behavioral1
Sample
832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe
Resource
win10v2004-20220812-en
General
-
Target
832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe
-
Size
1.2MB
-
MD5
f1d484afa90b50c5a5d4552d87a4ea1a
-
SHA1
c0f7cbec80db02dc08395f072b07bdcd9e29d7b4
-
SHA256
832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd
-
SHA512
24fab820edf076b75fab614edc190ada27ebd4487974b49bf2d309e6e5c0034a34b373beb6fbeb25ccbf65899c0a60b9d6b328ff731837ee38af3a63e11b7516
-
SSDEEP
3072:iyf8n+BnNpiXN5U+M/hQuaCA3VMxDJAQO7LN:i/+BnNpCqP/hQuavirOH
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
winlogon.exewinlogon.exewinlogon.exewinlogon.exepid process 4272 winlogon.exe 4768 winlogon.exe 2132 winlogon.exe 4700 winlogon.exe -
Processes:
resource yara_rule behavioral2/memory/2228-134-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2228-136-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2228-137-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2228-140-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2228-147-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4768-154-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exewinlogon.exewinlogon.exedescription pid process target process PID 2356 set thread context of 2228 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe PID 4272 set thread context of 4768 4272 winlogon.exe winlogon.exe PID 4768 set thread context of 2132 4768 winlogon.exe winlogon.exe PID 4768 set thread context of 4700 4768 winlogon.exe winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4464 4700 WerFault.exe winlogon.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exewinlogon.exepid process 2228 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe 4768 winlogon.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exewinlogon.exewinlogon.exedescription pid process target process PID 2356 wrote to memory of 1944 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe svchost.exe PID 2356 wrote to memory of 1944 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe svchost.exe PID 2356 wrote to memory of 1944 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe svchost.exe PID 2356 wrote to memory of 2228 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe PID 2356 wrote to memory of 2228 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe PID 2356 wrote to memory of 2228 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe PID 2356 wrote to memory of 2228 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe PID 2356 wrote to memory of 2228 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe PID 2356 wrote to memory of 2228 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe PID 2356 wrote to memory of 2228 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe PID 2356 wrote to memory of 2228 2356 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe PID 2228 wrote to memory of 4272 2228 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe winlogon.exe PID 2228 wrote to memory of 4272 2228 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe winlogon.exe PID 2228 wrote to memory of 4272 2228 832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe winlogon.exe PID 4272 wrote to memory of 4968 4272 winlogon.exe svchost.exe PID 4272 wrote to memory of 4968 4272 winlogon.exe svchost.exe PID 4272 wrote to memory of 4968 4272 winlogon.exe svchost.exe PID 4272 wrote to memory of 4768 4272 winlogon.exe winlogon.exe PID 4272 wrote to memory of 4768 4272 winlogon.exe winlogon.exe PID 4272 wrote to memory of 4768 4272 winlogon.exe winlogon.exe PID 4272 wrote to memory of 4768 4272 winlogon.exe winlogon.exe PID 4272 wrote to memory of 4768 4272 winlogon.exe winlogon.exe PID 4272 wrote to memory of 4768 4272 winlogon.exe winlogon.exe PID 4272 wrote to memory of 4768 4272 winlogon.exe winlogon.exe PID 4272 wrote to memory of 4768 4272 winlogon.exe winlogon.exe PID 4768 wrote to memory of 2132 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 2132 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 2132 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 2132 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 2132 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 2132 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 2132 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 2132 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 4700 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 4700 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 4700 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 4700 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 4700 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 4700 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 4700 4768 winlogon.exe winlogon.exe PID 4768 wrote to memory of 4700 4768 winlogon.exe winlogon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe"C:\Users\Admin\AppData\Local\Temp\832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\\svchost.exe2⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd.exe
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\\svchost.exe4⤵PID:4968
-
C:\Users\Admin\E696D64614\winlogon.exe
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"5⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"5⤵
- Executes dropped EXE
PID:4700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 126⤵
- Program crash
PID:4464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2132 -ip 21321⤵PID:4012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4700 -ip 47001⤵PID:956
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\E696D64614\winlogon.exeFilesize
1.2MB
MD5f1d484afa90b50c5a5d4552d87a4ea1a
SHA1c0f7cbec80db02dc08395f072b07bdcd9e29d7b4
SHA256832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd
SHA51224fab820edf076b75fab614edc190ada27ebd4487974b49bf2d309e6e5c0034a34b373beb6fbeb25ccbf65899c0a60b9d6b328ff731837ee38af3a63e11b7516
-
C:\Users\Admin\E696D64614\winlogon.exeFilesize
1.2MB
MD5f1d484afa90b50c5a5d4552d87a4ea1a
SHA1c0f7cbec80db02dc08395f072b07bdcd9e29d7b4
SHA256832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd
SHA51224fab820edf076b75fab614edc190ada27ebd4487974b49bf2d309e6e5c0034a34b373beb6fbeb25ccbf65899c0a60b9d6b328ff731837ee38af3a63e11b7516
-
C:\Users\Admin\E696D64614\winlogon.exeFilesize
1.2MB
MD5f1d484afa90b50c5a5d4552d87a4ea1a
SHA1c0f7cbec80db02dc08395f072b07bdcd9e29d7b4
SHA256832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd
SHA51224fab820edf076b75fab614edc190ada27ebd4487974b49bf2d309e6e5c0034a34b373beb6fbeb25ccbf65899c0a60b9d6b328ff731837ee38af3a63e11b7516
-
C:\Users\Admin\E696D64614\winlogon.exeFilesize
1.2MB
MD5f1d484afa90b50c5a5d4552d87a4ea1a
SHA1c0f7cbec80db02dc08395f072b07bdcd9e29d7b4
SHA256832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd
SHA51224fab820edf076b75fab614edc190ada27ebd4487974b49bf2d309e6e5c0034a34b373beb6fbeb25ccbf65899c0a60b9d6b328ff731837ee38af3a63e11b7516
-
C:\Users\Admin\E696D64614\winlogon.exeFilesize
1.2MB
MD5f1d484afa90b50c5a5d4552d87a4ea1a
SHA1c0f7cbec80db02dc08395f072b07bdcd9e29d7b4
SHA256832844688a4199bfff145ec64d59492a72772d1ea254a913d9a4d38d438d04bd
SHA51224fab820edf076b75fab614edc190ada27ebd4487974b49bf2d309e6e5c0034a34b373beb6fbeb25ccbf65899c0a60b9d6b328ff731837ee38af3a63e11b7516
-
memory/1944-132-0x0000000000000000-mapping.dmp
-
memory/2132-155-0x0000000000000000-mapping.dmp
-
memory/2228-133-0x0000000000000000-mapping.dmp
-
memory/2228-134-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2228-136-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2228-147-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2228-140-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2228-137-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/4272-141-0x0000000000000000-mapping.dmp
-
memory/4700-158-0x0000000000000000-mapping.dmp
-
memory/4768-145-0x0000000000000000-mapping.dmp
-
memory/4768-154-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/4968-144-0x0000000000000000-mapping.dmp