Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 18:02
Behavioral task
behavioral1
Sample
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe
Resource
win10v2004-20220812-en
General
-
Target
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe
-
Size
56KB
-
MD5
f1df8c367943c17dfebdd15b127e33e7
-
SHA1
fe898d4f2cf5b793368a071e9f9590cd4cc4e2ef
-
SHA256
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18
-
SHA512
55ca309b55da46a1a27962d477524bc8cbdd929583b716725efa425ea775aba7f8a4c2c7a798c9a3897ee50bf183ceed8ee5a4c7288f16d361ef4926252535ef
-
SSDEEP
768:QUuzp0fg4fyRR5tHC4kt5Jp9k0FBxTJp8jSE5+Nk/QBeLPJbukgb4a:zfFYrHzmJcABxt2mE5OAkYJyz4a
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
123.exepid process 4884 123.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\123\Parameters\ServiceDll = "C:\\Program Files (x86)\\Google\\240552281.dll" f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe -
Loads dropped DLL 3 IoCs
Processes:
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exesvchost.exe123.exepid process 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe 4088 svchost.exe 4884 123.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\123.exe svchost.exe File opened for modification C:\Windows\SysWOW64\123.exe svchost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exedescription ioc process File created C:\Program Files (x86)\Google\240552281.dll f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exepid process 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exedescription pid process Token: SeIncBasePriorityPrivilege 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exepid process 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.execmd.exesvchost.exedescription pid process target process PID 740 wrote to memory of 4944 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe cmd.exe PID 740 wrote to memory of 4944 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe cmd.exe PID 740 wrote to memory of 4944 740 f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe cmd.exe PID 4944 wrote to memory of 4416 4944 cmd.exe PING.EXE PID 4944 wrote to memory of 4416 4944 cmd.exe PING.EXE PID 4944 wrote to memory of 4416 4944 cmd.exe PING.EXE PID 4088 wrote to memory of 4884 4088 svchost.exe 123.exe PID 4088 wrote to memory of 4884 4088 svchost.exe 123.exe PID 4088 wrote to memory of 4884 4088 svchost.exe 123.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe"C:\Users\Admin\AppData\Local\Temp\f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe"1⤵
- Sets DLL path for service in the registry
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:4416
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "123"1⤵PID:4232
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "123"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\123.exeC:\Windows\system32\123.exe "c:\program files (x86)\google\240552281.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD57584e503fa363f192940905470467f87
SHA1212df83d88300008faef1730d14f7945930c6836
SHA256b041bd2a32989f79b513e54bec057e6f5769eb00f95011ae1e7e487df407a913
SHA512c4835b299d62a821cff5eae30809d26011838443e7fab554ab2884d7cf9e17a720ceb38086ccac09ee5f99ce1bc7ebdf1e11114960101fb56e010a97168568e5
-
Filesize
26KB
MD57584e503fa363f192940905470467f87
SHA1212df83d88300008faef1730d14f7945930c6836
SHA256b041bd2a32989f79b513e54bec057e6f5769eb00f95011ae1e7e487df407a913
SHA512c4835b299d62a821cff5eae30809d26011838443e7fab554ab2884d7cf9e17a720ceb38086ccac09ee5f99ce1bc7ebdf1e11114960101fb56e010a97168568e5
-
Filesize
26KB
MD57584e503fa363f192940905470467f87
SHA1212df83d88300008faef1730d14f7945930c6836
SHA256b041bd2a32989f79b513e54bec057e6f5769eb00f95011ae1e7e487df407a913
SHA512c4835b299d62a821cff5eae30809d26011838443e7fab554ab2884d7cf9e17a720ceb38086ccac09ee5f99ce1bc7ebdf1e11114960101fb56e010a97168568e5
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
26KB
MD57584e503fa363f192940905470467f87
SHA1212df83d88300008faef1730d14f7945930c6836
SHA256b041bd2a32989f79b513e54bec057e6f5769eb00f95011ae1e7e487df407a913
SHA512c4835b299d62a821cff5eae30809d26011838443e7fab554ab2884d7cf9e17a720ceb38086ccac09ee5f99ce1bc7ebdf1e11114960101fb56e010a97168568e5