Analysis
-
max time kernel
147s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 12:05
Static task
static1
Behavioral task
behavioral1
Sample
888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe
Resource
win10v2004-20220812-en
General
-
Target
888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe
-
Size
69KB
-
MD5
f074556b4be98813ee28a8bacf6bc8b4
-
SHA1
2b4ab011bb9e7490a3cb74892d47e8fe8e033566
-
SHA256
888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105
-
SHA512
6dd7a66bcf8cd34440be3ebb1d93650af13b358759865e7dbb02aa8cd3760be16f8aadbe4e8fda8a4497c0e38bd2e459c1e8211031a5f8c78449659d7bb47015
-
SSDEEP
1536:fvzDxcAxg2oucEYl0a7y9jjO8ueosFIzh:fJcAxg2ohlR7wjipPzh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
java.exepid process 4180 java.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iCloud = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\java.exe" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\java.exe" java.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exejava.exepid process 4512 888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe 4180 java.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
java.exepid process 4180 java.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exejava.exedescription pid process Token: SeDebugPrivilege 4512 888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe Token: SeDebugPrivilege 4180 java.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
java.exepid process 4180 java.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.execmd.exedescription pid process target process PID 4512 wrote to memory of 2232 4512 888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe cmd.exe PID 4512 wrote to memory of 2232 4512 888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe cmd.exe PID 2232 wrote to memory of 3024 2232 cmd.exe PING.EXE PID 2232 wrote to memory of 3024 2232 cmd.exe PING.EXE PID 4512 wrote to memory of 4180 4512 888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe java.exe PID 4512 wrote to memory of 4180 4512 888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe java.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe"C:\Users\Admin\AppData\Local\Temp\888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ping -n 3 127.0.0.1 > nul & del "C:\Users\Admin\AppData\Local\Temp\888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 3 127.0.0.13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\Java\java.exe"C:\Users\Admin\AppData\Roaming\Java\java.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Java\java.exeFilesize
69KB
MD5f074556b4be98813ee28a8bacf6bc8b4
SHA12b4ab011bb9e7490a3cb74892d47e8fe8e033566
SHA256888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105
SHA5126dd7a66bcf8cd34440be3ebb1d93650af13b358759865e7dbb02aa8cd3760be16f8aadbe4e8fda8a4497c0e38bd2e459c1e8211031a5f8c78449659d7bb47015
-
C:\Users\Admin\AppData\Roaming\Java\java.exeFilesize
69KB
MD5f074556b4be98813ee28a8bacf6bc8b4
SHA12b4ab011bb9e7490a3cb74892d47e8fe8e033566
SHA256888cef07ce0e3d3b5f9d0862e5ff1286049028204046ade72f16fce735a44105
SHA5126dd7a66bcf8cd34440be3ebb1d93650af13b358759865e7dbb02aa8cd3760be16f8aadbe4e8fda8a4497c0e38bd2e459c1e8211031a5f8c78449659d7bb47015
-
memory/2232-133-0x0000000000000000-mapping.dmp
-
memory/3024-134-0x0000000000000000-mapping.dmp
-
memory/4180-138-0x00007FFA787C0000-0x00007FFA791F6000-memory.dmpFilesize
10.2MB
-
memory/4180-135-0x0000000000000000-mapping.dmp
-
memory/4180-139-0x0000000000AC9000-0x0000000000ACF000-memory.dmpFilesize
24KB
-
memory/4180-140-0x000000001D7C0000-0x000000001D7C3000-memory.dmpFilesize
12KB
-
memory/4180-141-0x000000001D7C0000-0x000000001D7C3000-memory.dmpFilesize
12KB
-
memory/4180-142-0x000000001D7C3000-0x000000001D7C6000-memory.dmpFilesize
12KB
-
memory/4180-143-0x000000001D7C6000-0x000000001D7C9000-memory.dmpFilesize
12KB
-
memory/4180-144-0x000000001D7C9000-0x000000001D7CC000-memory.dmpFilesize
12KB
-
memory/4180-145-0x000000001D7CC000-0x000000001D7D1000-memory.dmpFilesize
20KB
-
memory/4180-146-0x000000001D7D1000-0x000000001D7D6000-memory.dmpFilesize
20KB
-
memory/4512-132-0x00007FFA787C0000-0x00007FFA791F6000-memory.dmpFilesize
10.2MB