Analysis
-
max time kernel
156s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 08:44
Static task
static1
Behavioral task
behavioral1
Sample
19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8.exe
Resource
win10v2004-20220812-en
General
-
Target
19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8.exe
-
Size
43KB
-
MD5
d6aa3f866713a446f464542cc36caa87
-
SHA1
54854abc0892e096be0d4e72c248a372eedf0e25
-
SHA256
19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8
-
SHA512
af6c8f1a15a317799d463b00cdc84ba8d5d9fb6ac1a76e334af37fc6ac242b00180fd18ea0515f47b328a6ad55080ba9f7b550e2fd082bfed48c74a5ced2930e
-
SSDEEP
768:aUHDZ8y9MHHSqSwfSre9WTZ2S1581N6HUjHPSqvtK1o7Mr1PTEN5a38HCCjPka66:faWE5o81W1bEDHCCrk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Chrome.exepid process 4396 Chrome.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8.exe -
Drops startup file 2 IoCs
Processes:
Chrome.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e79d569ba77562f0d4316e586835f0a2.exe Chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e79d569ba77562f0d4316e586835f0a2.exe Chrome.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Chrome.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e79d569ba77562f0d4316e586835f0a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Chrome.exe\" .." Chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e79d569ba77562f0d4316e586835f0a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Chrome.exe\" .." Chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
Chrome.exepid process 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe 4396 Chrome.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
dw20.exeChrome.exedescription pid process Token: SeRestorePrivilege 432 dw20.exe Token: SeBackupPrivilege 432 dw20.exe Token: SeDebugPrivilege 4396 Chrome.exe Token: SeBackupPrivilege 432 dw20.exe Token: SeBackupPrivilege 432 dw20.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8.exeChrome.exedescription pid process target process PID 5040 wrote to memory of 4396 5040 19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8.exe Chrome.exe PID 5040 wrote to memory of 4396 5040 19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8.exe Chrome.exe PID 5040 wrote to memory of 4396 5040 19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8.exe Chrome.exe PID 4396 wrote to memory of 432 4396 Chrome.exe dw20.exe PID 4396 wrote to memory of 432 4396 Chrome.exe dw20.exe PID 4396 wrote to memory of 432 4396 Chrome.exe dw20.exe PID 4396 wrote to memory of 5116 4396 Chrome.exe netsh.exe PID 4396 wrote to memory of 5116 4396 Chrome.exe netsh.exe PID 4396 wrote to memory of 5116 4396 Chrome.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8.exe"C:\Users\Admin\AppData\Local\Temp\19a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\Chrome.exe"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7803⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:432 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Chrome.exe" "Chrome.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:5116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exeFilesize
43KB
MD5d6aa3f866713a446f464542cc36caa87
SHA154854abc0892e096be0d4e72c248a372eedf0e25
SHA25619a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8
SHA512af6c8f1a15a317799d463b00cdc84ba8d5d9fb6ac1a76e334af37fc6ac242b00180fd18ea0515f47b328a6ad55080ba9f7b550e2fd082bfed48c74a5ced2930e
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exeFilesize
43KB
MD5d6aa3f866713a446f464542cc36caa87
SHA154854abc0892e096be0d4e72c248a372eedf0e25
SHA25619a527964d791455a0b24b904962ba9267eb9c47c337a2a34eb97d77302548f8
SHA512af6c8f1a15a317799d463b00cdc84ba8d5d9fb6ac1a76e334af37fc6ac242b00180fd18ea0515f47b328a6ad55080ba9f7b550e2fd082bfed48c74a5ced2930e
-
memory/432-136-0x0000000000000000-mapping.dmp
-
memory/4396-133-0x0000000000000000-mapping.dmp
-
memory/4396-138-0x0000000074780000-0x0000000074D31000-memory.dmpFilesize
5.7MB
-
memory/4396-140-0x0000000074780000-0x0000000074D31000-memory.dmpFilesize
5.7MB
-
memory/5040-132-0x0000000074780000-0x0000000074D31000-memory.dmpFilesize
5.7MB
-
memory/5040-139-0x0000000074780000-0x0000000074D31000-memory.dmpFilesize
5.7MB
-
memory/5116-137-0x0000000000000000-mapping.dmp