b0352074c6f0556acf2215aa41e485085b1c7561f645f1d314a570acd31ccc1b

Analysis

max time kernel
178s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2014-12-22 #32/12923268c928f103f7f0164be1985cb2.exe
Size

515KB
MD5

12923268c928f103f7f0164be1985cb2
SHA1

41639e6149ca574291ce3e3efaefa4e6f8f57ade
SHA256

693527e991f70f27827eabad1a49886a1009055061e39ca1c9a5557dcc10e56c
SHA512

455237c02d69c535e7ac0db8580d1e4029fba185839f9fc828ced61ce338aaf7d2fe460869049680cca9cd8701721e5b360a3901c818faf0a1ad327debf071ff
SSDEEP

3072:8nrRqBYMmJ6ZL4ueKhhf74xzSSxLGOr9iehVhybyGRO+3sPBnQ79JqUT:8SD9ZL4utwzSe9GROnBQKs

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

WI-FI Hack 2015.exe

pid process

3048 WI-FI Hack 2015.exe

pid	process
3048	WI-FI Hack 2015.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

12923268c928f103f7f0164be1985cb2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	12923268c928f103f7f0164be1985cb2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

dw20.exe

description	pid	process
Token: SeRestorePrivilege	2912	dw20.exe
Token: SeBackupPrivilege	2912	dw20.exe
Token: SeBackupPrivilege	2912	dw20.exe
Token: SeBackupPrivilege	2912	dw20.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

12923268c928f103f7f0164be1985cb2.exeWI-FI Hack 2015.exe

description	pid	process	target process
PID 3276 wrote to memory of 3048	3276	12923268c928f103f7f0164be1985cb2.exe	WI-FI Hack 2015.exe
PID 3276 wrote to memory of 3048	3276	12923268c928f103f7f0164be1985cb2.exe	WI-FI Hack 2015.exe
PID 3276 wrote to memory of 3048	3276	12923268c928f103f7f0164be1985cb2.exe	WI-FI Hack 2015.exe
PID 3048 wrote to memory of 2912	3048	WI-FI Hack 2015.exe	dw20.exe
PID 3048 wrote to memory of 2912	3048	WI-FI Hack 2015.exe	dw20.exe
PID 3048 wrote to memory of 2912	3048	WI-FI Hack 2015.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\2014-12-22 #32\12923268c928f103f7f0164be1985cb2.exe
"C:\Users\Admin\AppData\Local\Temp\2014-12-22 #32\12923268c928f103f7f0164be1985cb2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Users\Admin\AppData\Local\Temp\WI-FI Hack 2015.exe
  "C:\Users\Admin\AppData\Local\Temp\WI-FI Hack 2015.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 848
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WI-FI Hack 2015.exe

Filesize
264KB

MD5
f098812bcfd1e7cc90db31f6e811e13e

SHA1
1e44e37cd5d176a8224187ff86e1d8eb9528c61a

SHA256
e4847e553a400fddda671b8246a0aa9bbbcbb2df39016d9c1afc35f6e6c7d2a3

SHA512
c237dc7288b24b45eba8647a575902c8590d03386f409900e0675f4d7d5ef44195f70536fd637f9748e27cdaa22913f0fc5202c0d17b463b5ec9b793bdf36108

Download Submit
C:\Users\Admin\AppData\Local\Temp\WI-FI Hack 2015.exe

Filesize
264KB

MD5
f098812bcfd1e7cc90db31f6e811e13e

SHA1
1e44e37cd5d176a8224187ff86e1d8eb9528c61a

SHA256
e4847e553a400fddda671b8246a0aa9bbbcbb2df39016d9c1afc35f6e6c7d2a3

SHA512
c237dc7288b24b45eba8647a575902c8590d03386f409900e0675f4d7d5ef44195f70536fd637f9748e27cdaa22913f0fc5202c0d17b463b5ec9b793bdf36108

Download Submit
memory/2912-137-0x0000000000000000-mapping.dmp

Download
memory/3048-132-0x0000000000000000-mapping.dmp

Download
memory/3048-135-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/3048-136-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download
memory/3048-138-0x0000000075230000-0x00000000757E1000-memory.dmp

Filesize
5.7MB

Download