Analysis
-
max time kernel
279s -
max time network
293s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:22
Static task
static1
Behavioral task
behavioral1
Sample
327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe
Resource
win7-20220812-en
General
-
Target
327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe
-
Size
612KB
-
MD5
fa2b2bf45bbd6d6dc2f1afc683bea85c
-
SHA1
28fdb35377468f84df6aec2eb4e16ca3986b4387
-
SHA256
327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6
-
SHA512
bbc1e9aec1da4f8fea99c6d42c7abfbbe61522c55621dae79d81122cc5b7a601b0b085570a5dd936adf6f50024e06e831db058a327fbfd80922723b7645c0d89
-
SSDEEP
6144:48XXRUw9Oz5+iUU03pej1YpTYzOb0kLXhlJFTaLTGu0yvHcr+JB8aUn/0vQPT20Q:7nRy+ZyYpaCDJFuPyAHcqrUns9v2V+yc
Malware Config
Signatures
-
Processes:
fdiwjegfpns.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fdiwjegfpns.exe -
Executes dropped EXE 1 IoCs
Processes:
fdiwjegfpns.exepid process 4636 fdiwjegfpns.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe -
Processes:
fdiwjegfpns.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fdiwjegfpns.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fdiwjegfpns.exe -
Drops file in System32 directory 14 IoCs
Processes:
fdiwjegfpns.exedescription ioc process File created C:\Windows\SysWOW64\btjdvhexmzfjuohiq.exe fdiwjegfpns.exe File opened for modification C:\Windows\SysWOW64\vphdxlkfwltzmidgqxz.exe fdiwjegfpns.exe File created C:\Windows\SysWOW64\kdupivtndrydpkegpv.exe fdiwjegfpns.exe File opened for modification C:\Windows\SysWOW64\idwtoddzrhqxlieitbez.exe fdiwjegfpns.exe File opened for modification C:\Windows\SysWOW64\olgfctvtnfqzpomsfpurml.exe fdiwjegfpns.exe File created C:\Windows\SysWOW64\olgfctvtnfqzpomsfpurml.exe fdiwjegfpns.exe File opened for modification C:\Windows\SysWOW64\ulatkvrjxjorbumm.exe fdiwjegfpns.exe File created C:\Windows\SysWOW64\ulatkvrjxjorbumm.exe fdiwjegfpns.exe File opened for modification C:\Windows\SysWOW64\btjdvhexmzfjuohiq.exe fdiwjegfpns.exe File opened for modification C:\Windows\SysWOW64\kdupivtndrydpkegpv.exe fdiwjegfpns.exe File created C:\Windows\SysWOW64\idwtoddzrhqxlieitbez.exe fdiwjegfpns.exe File opened for modification C:\Windows\SysWOW64\xtnlhxyvofpxmkhmyhlhb.exe fdiwjegfpns.exe File created C:\Windows\SysWOW64\vphdxlkfwltzmidgqxz.exe fdiwjegfpns.exe File created C:\Windows\SysWOW64\xtnlhxyvofpxmkhmyhlhb.exe fdiwjegfpns.exe -
Drops file in Windows directory 14 IoCs
Processes:
fdiwjegfpns.exedescription ioc process File opened for modification C:\Windows\btjdvhexmzfjuohiq.exe fdiwjegfpns.exe File created C:\Windows\btjdvhexmzfjuohiq.exe fdiwjegfpns.exe File created C:\Windows\olgfctvtnfqzpomsfpurml.exe fdiwjegfpns.exe File created C:\Windows\ulatkvrjxjorbumm.exe fdiwjegfpns.exe File created C:\Windows\vphdxlkfwltzmidgqxz.exe fdiwjegfpns.exe File opened for modification C:\Windows\idwtoddzrhqxlieitbez.exe fdiwjegfpns.exe File opened for modification C:\Windows\xtnlhxyvofpxmkhmyhlhb.exe fdiwjegfpns.exe File created C:\Windows\xtnlhxyvofpxmkhmyhlhb.exe fdiwjegfpns.exe File opened for modification C:\Windows\olgfctvtnfqzpomsfpurml.exe fdiwjegfpns.exe File opened for modification C:\Windows\ulatkvrjxjorbumm.exe fdiwjegfpns.exe File opened for modification C:\Windows\kdupivtndrydpkegpv.exe fdiwjegfpns.exe File created C:\Windows\kdupivtndrydpkegpv.exe fdiwjegfpns.exe File opened for modification C:\Windows\vphdxlkfwltzmidgqxz.exe fdiwjegfpns.exe File created C:\Windows\idwtoddzrhqxlieitbez.exe fdiwjegfpns.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exepid process 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exedescription pid process target process PID 1268 wrote to memory of 4636 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe fdiwjegfpns.exe PID 1268 wrote to memory of 4636 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe fdiwjegfpns.exe PID 1268 wrote to memory of 4636 1268 327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe fdiwjegfpns.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
fdiwjegfpns.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fdiwjegfpns.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fdiwjegfpns.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe"C:\Users\Admin\AppData\Local\Temp\327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\fdiwjegfpns.exe"C:\Users\Admin\AppData\Local\Temp\fdiwjegfpns.exe" "c:\users\admin\appdata\local\temp\327f3735753722cce7efc978fc5fd0d9be59c5013499e4c177a3636c22e02dd6.exe*"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:4636
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fdiwjegfpns.exeFilesize
308KB
MD585cb856b920e7b0b7b75115336fc2af2
SHA11d1a207efec2f5187583b652c35aef74ee4c473f
SHA2566fff20aabe8265b6e811c9dbcb987f9c15cf07d1d8b80ced7b287d96900f5c62
SHA512120ff9c77c19216e5691b6ba812f09f7db7b46685a391027fff56e5b73200f4211b6bac2c2d28cdfe461d1fbf10f1a3204adeedbd0a34a034a862c6278d901e8
-
C:\Users\Admin\AppData\Local\Temp\fdiwjegfpns.exeFilesize
308KB
MD585cb856b920e7b0b7b75115336fc2af2
SHA11d1a207efec2f5187583b652c35aef74ee4c473f
SHA2566fff20aabe8265b6e811c9dbcb987f9c15cf07d1d8b80ced7b287d96900f5c62
SHA512120ff9c77c19216e5691b6ba812f09f7db7b46685a391027fff56e5b73200f4211b6bac2c2d28cdfe461d1fbf10f1a3204adeedbd0a34a034a862c6278d901e8
-
memory/4636-132-0x0000000000000000-mapping.dmp