Analysis
-
max time kernel
92s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 01:57
Behavioral task
behavioral1
Sample
14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76.exe
Resource
win10v2004-20220812-en
General
-
Target
14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76.exe
-
Size
428KB
-
MD5
2affe37ac296e347413a30637ccc312e
-
SHA1
ef58761ae5a2eae451791e1c3973b51e4467b556
-
SHA256
14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76
-
SHA512
312be8cfe9d6dd147b66173cee0d8a8dc3d31840f10cb4bddc490c00b26400f151c87a7440f42ed3e5a1885ba59935d6a108d87f3c47b3894ac0e9befc17638c
-
SSDEEP
6144:W69PdKMCMrC1+CrLtVgjEip1qQ5JXTLF6LZI+/LhJ/zv7bT3kdDy58gzCjNItS:WoOMSrZa7GY/FEZIirv7P3kcCgzPtS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Crypted.exepid process 4920 Crypted.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Crypted.exedw20.exedescription pid process Token: SeDebugPrivilege 4920 Crypted.exe Token: SeRestorePrivilege 2856 dw20.exe Token: SeBackupPrivilege 2856 dw20.exe Token: SeBackupPrivilege 2856 dw20.exe Token: SeBackupPrivilege 2856 dw20.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76.exeCrypted.exedescription pid process target process PID 4704 wrote to memory of 4920 4704 14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76.exe Crypted.exe PID 4704 wrote to memory of 4920 4704 14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76.exe Crypted.exe PID 4704 wrote to memory of 4920 4704 14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76.exe Crypted.exe PID 4920 wrote to memory of 2856 4920 Crypted.exe dw20.exe PID 4920 wrote to memory of 2856 4920 Crypted.exe dw20.exe PID 4920 wrote to memory of 2856 4920 Crypted.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76.exe"C:\Users\Admin\AppData\Local\Temp\14200ac44d5c28964090030d64f9dfa5e98f2764c03d7806c4e9721100b66b76.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\Crypted.exe"C:\Users\Admin\AppData\Local\Temp\Crypted.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 11403⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2856
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Crypted.exeFilesize
389KB
MD5d553cc1cc4dceaaf5d4f494f1384a3d1
SHA18f1aa3a36199b564f91a5b678ddd52063a5e4b33
SHA2564cb2928794c8de724e4192202e2dfde3bd6fe8e5f4ec32852ea637d3dc897f84
SHA512497e49f2b8bf238b8a76ed9403151d576a08c804d80bb2dbac304f2eeec3b5d1fd734023d2899f22968b75654d1da9f64f2edc4fd18ac1b0208788a5a08620ad
-
C:\Users\Admin\AppData\Local\Temp\Crypted.exeFilesize
389KB
MD5d553cc1cc4dceaaf5d4f494f1384a3d1
SHA18f1aa3a36199b564f91a5b678ddd52063a5e4b33
SHA2564cb2928794c8de724e4192202e2dfde3bd6fe8e5f4ec32852ea637d3dc897f84
SHA512497e49f2b8bf238b8a76ed9403151d576a08c804d80bb2dbac304f2eeec3b5d1fd734023d2899f22968b75654d1da9f64f2edc4fd18ac1b0208788a5a08620ad
-
memory/2856-478-0x0000000000000000-mapping.dmp
-
memory/4920-132-0x0000000000000000-mapping.dmp
-
memory/4920-135-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-139-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-140-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-138-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-142-0x0000000075100000-0x00000000756B1000-memory.dmpFilesize
5.7MB
-
memory/4920-141-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-143-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-144-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-145-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-146-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-147-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-148-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-150-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-149-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-151-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-152-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-153-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-154-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-155-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-157-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-158-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-159-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-156-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-160-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-161-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-162-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-163-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-164-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-165-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-167-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-168-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-169-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-166-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-170-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-171-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-172-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-173-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-174-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-175-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-176-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-177-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-178-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-179-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-180-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-181-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-182-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-183-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-184-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-185-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-187-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-186-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-189-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-188-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-190-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-191-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-192-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-193-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-194-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-196-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-199-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-198-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-197-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-195-0x0000000000680000-0x00000000006D4000-memory.dmpFilesize
336KB
-
memory/4920-477-0x0000000075100000-0x00000000756B1000-memory.dmpFilesize
5.7MB
-
memory/4920-479-0x0000000075100000-0x00000000756B1000-memory.dmpFilesize
5.7MB