Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 21:16
Behavioral task
behavioral1
Sample
4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe
Resource
win10v2004-20220901-en
General
-
Target
4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe
-
Size
994KB
-
MD5
e8d1ba2baf31e50c594b39f6e8259827
-
SHA1
c5a82f2170089b6e73f8d23946e037c9ab27901e
-
SHA256
4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479
-
SHA512
c0f8861e95ad8e7d247368cd9efa9812c7765bae9533589e43d22c7810cf3ead0a18002450deaeedaeec3b1f426c95ec9784bedec49b44c95d8345dc15cc0709
-
SSDEEP
24576:bJ1G2X131Rc5sUQxButHmYj8lJTeasASBlEev:v1FWsXx4tGcKTed/l1
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
driveridentifier_setup.exesystem.exedriveridentifier_setup.tmppid process 2168 driveridentifier_setup.exe 1284 system.exe 2104 driveridentifier_setup.tmp -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe -
Drops startup file 2 IoCs
Processes:
system.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\12ce4e06a81e8d54fd01d9b762f1b1bb.exe system.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\12ce4e06a81e8d54fd01d9b762f1b1bb.exe system.exe -
Loads dropped DLL 1 IoCs
Processes:
driveridentifier_setup.tmppid process 2104 driveridentifier_setup.tmp -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
system.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12ce4e06a81e8d54fd01d9b762f1b1bb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe\" .." system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\12ce4e06a81e8d54fd01d9b762f1b1bb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe\" .." system.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
system.exepid process 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe 1284 system.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
system.exedescription pid process Token: SeDebugPrivilege 1284 system.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exedriveridentifier_setup.exesystem.exedescription pid process target process PID 4832 wrote to memory of 2168 4832 4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe driveridentifier_setup.exe PID 4832 wrote to memory of 2168 4832 4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe driveridentifier_setup.exe PID 4832 wrote to memory of 2168 4832 4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe driveridentifier_setup.exe PID 4832 wrote to memory of 1284 4832 4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe system.exe PID 4832 wrote to memory of 1284 4832 4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe system.exe PID 4832 wrote to memory of 1284 4832 4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe system.exe PID 2168 wrote to memory of 2104 2168 driveridentifier_setup.exe driveridentifier_setup.tmp PID 2168 wrote to memory of 2104 2168 driveridentifier_setup.exe driveridentifier_setup.tmp PID 2168 wrote to memory of 2104 2168 driveridentifier_setup.exe driveridentifier_setup.tmp PID 1284 wrote to memory of 396 1284 system.exe netsh.exe PID 1284 wrote to memory of 396 1284 system.exe netsh.exe PID 1284 wrote to memory of 396 1284 system.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe"C:\Users\Admin\AppData\Local\Temp\4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\system.exe" "system.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:396 -
C:\Users\Admin\AppData\Local\Temp\driveridentifier_setup.exe"C:\Users\Admin\AppData\Local\Temp\driveridentifier_setup.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168
-
C:\Users\Admin\AppData\Local\Temp\is-04E8M.tmp\driveridentifier_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-04E8M.tmp\driveridentifier_setup.tmp" /SL5="$E003A,699379,62976,C:\Users\Admin\AppData\Local\Temp\driveridentifier_setup.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\driveridentifier_setup.exeFilesize
927KB
MD540a5f0095e1eaf4da27bcdd4ae8874c5
SHA149c911b29eef3783e1673a9adfb8a432fb5632b8
SHA25621974a5291a4562fb6ee499f0cb344e5c298a991e1a287107a97dba102213baf
SHA51275d00991c241893c2c319cf63d7f043a6cfd4b48236919b9610dd256610e294b7fc8a5cf3ff9e3b33675c4dd02ae5913ac09f7225cf3b4a51dc665b3fb8077e5
-
C:\Users\Admin\AppData\Local\Temp\driveridentifier_setup.exeFilesize
927KB
MD540a5f0095e1eaf4da27bcdd4ae8874c5
SHA149c911b29eef3783e1673a9adfb8a432fb5632b8
SHA25621974a5291a4562fb6ee499f0cb344e5c298a991e1a287107a97dba102213baf
SHA51275d00991c241893c2c319cf63d7f043a6cfd4b48236919b9610dd256610e294b7fc8a5cf3ff9e3b33675c4dd02ae5913ac09f7225cf3b4a51dc665b3fb8077e5
-
C:\Users\Admin\AppData\Local\Temp\is-04E8M.tmp\driveridentifier_setup.tmpFilesize
697KB
MD5c3553dc2e0b40670b9746b13c9179a3f
SHA19026696a2ee0397e66ca7def17ee63edb6b5586f
SHA2567f4ba3fce0ecedc1a9ce87cea73c537b4d7b08675721f6fa55f9828611855916
SHA5127388af328fe5e6c408023b29645ba0b61b5f27a1ea79b36c733f19a7edcd32ddeb93c837b3ff4910a4ef29c5c5222574f2c4326ffaf5ab02ed2bb6c7b9c529b7
-
C:\Users\Admin\AppData\Local\Temp\is-04E8M.tmp\driveridentifier_setup.tmpFilesize
697KB
MD5c3553dc2e0b40670b9746b13c9179a3f
SHA19026696a2ee0397e66ca7def17ee63edb6b5586f
SHA2567f4ba3fce0ecedc1a9ce87cea73c537b4d7b08675721f6fa55f9828611855916
SHA5127388af328fe5e6c408023b29645ba0b61b5f27a1ea79b36c733f19a7edcd32ddeb93c837b3ff4910a4ef29c5c5222574f2c4326ffaf5ab02ed2bb6c7b9c529b7
-
C:\Users\Admin\AppData\Local\Temp\is-NQEUL.tmp\psvince.dllFilesize
36KB
MD5a4e5c512b047a6d9dc38549161cac4de
SHA149d3e74f9604a6c61cda04ccc6d3cda87e280dfb
SHA256c7f1e7e866834d9024f97c2b145c09d106e447e8abd65a10a1732116d178e44e
SHA5122edb8a492b8369d56dda735a652c9e08539a5c4709a794efaff91adcae192a636d0545725af16cf8c31b275b34c2f19e4b019b57fb9050b99de65a4c08e3eee1
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
43KB
MD56ecc309e80b69de489afff521878142f
SHA12d567e286598aa483aea81b32724fed46447c0aa
SHA2565e26917b4c48e0e8ecd6b62e183293d65d3d7e187aaa056cfcf7994c6a4880b0
SHA51258b33f00da911a0549c27e00b891f265d6606f1a3fa499d8e85318921b74b697fe2f337fc6a48ee711103dda1192a0a5659bce951d72a3267d476eadb7719b52
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
43KB
MD56ecc309e80b69de489afff521878142f
SHA12d567e286598aa483aea81b32724fed46447c0aa
SHA2565e26917b4c48e0e8ecd6b62e183293d65d3d7e187aaa056cfcf7994c6a4880b0
SHA51258b33f00da911a0549c27e00b891f265d6606f1a3fa499d8e85318921b74b697fe2f337fc6a48ee711103dda1192a0a5659bce951d72a3267d476eadb7719b52
-
memory/396-149-0x0000000000000000-mapping.dmp
-
memory/1284-140-0x0000000000000000-mapping.dmp
-
memory/1284-148-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/1284-150-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/2104-143-0x0000000000000000-mapping.dmp
-
memory/2168-138-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/2168-135-0x0000000000000000-mapping.dmp
-
memory/2168-146-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB