Analysis
-
max time kernel
185s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 08:38
Static task
static1
Behavioral task
behavioral1
Sample
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe
Resource
win10v2004-20220812-en
General
-
Target
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe
-
Size
175KB
-
MD5
fba3e964b429f06bea06e6d5e3ab8b08
-
SHA1
a13b91c0bc483458975a09330840521b269ffbbd
-
SHA256
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b
-
SHA512
c63431e907814f89d3b6d86fb95e637fc7ee15d0b23f8df0947e9e2f7fd8c528ab63d5b1723289e38ff66d63c252027846a0b092f387819ac407b27aba3588c1
-
SSDEEP
3072:23+zM8o1HWCbZa2C2wFP3KvqKHueMysYmPes/93JDYxBFt3xRKUFgXV+OBUFt8+c:25WWtIP8xwDJY8KI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1976 svchost.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\44f99d3a66eff659765dd3b8b0bbde86 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\44f99d3a66eff659765dd3b8b0bbde86 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .." svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exesvchost.exedescription pid process target process PID 1448 wrote to memory of 1976 1448 6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe svchost.exe PID 1448 wrote to memory of 1976 1448 6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe svchost.exe PID 1448 wrote to memory of 1976 1448 6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe svchost.exe PID 1976 wrote to memory of 4836 1976 svchost.exe netsh.exe PID 1976 wrote to memory of 4836 1976 svchost.exe netsh.exe PID 1976 wrote to memory of 4836 1976 svchost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe"C:\Users\Admin\AppData\Local\Temp\6557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:4836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
175KB
MD5fba3e964b429f06bea06e6d5e3ab8b08
SHA1a13b91c0bc483458975a09330840521b269ffbbd
SHA2566557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b
SHA512c63431e907814f89d3b6d86fb95e637fc7ee15d0b23f8df0947e9e2f7fd8c528ab63d5b1723289e38ff66d63c252027846a0b092f387819ac407b27aba3588c1
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
175KB
MD5fba3e964b429f06bea06e6d5e3ab8b08
SHA1a13b91c0bc483458975a09330840521b269ffbbd
SHA2566557a84c330d23063bb679aa3bed2a08cc92407649652ee1c08f2ac4a15df62b
SHA512c63431e907814f89d3b6d86fb95e637fc7ee15d0b23f8df0947e9e2f7fd8c528ab63d5b1723289e38ff66d63c252027846a0b092f387819ac407b27aba3588c1
-
memory/1448-132-0x0000000000350000-0x0000000000384000-memory.dmpFilesize
208KB
-
memory/1448-133-0x0000000004D20000-0x0000000004DBC000-memory.dmpFilesize
624KB
-
memory/1448-134-0x0000000005420000-0x00000000059C4000-memory.dmpFilesize
5.6MB
-
memory/1976-135-0x0000000000000000-mapping.dmp
-
memory/1976-139-0x0000000006B60000-0x0000000006BF2000-memory.dmpFilesize
584KB
-
memory/1976-140-0x0000000006AE0000-0x0000000006AEA000-memory.dmpFilesize
40KB
-
memory/4836-138-0x0000000000000000-mapping.dmp