03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee

Analysis

max time kernel
151s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
Size

686KB
MD5

c4884c93e73f7af897b8a63e5fbcb555
SHA1

e933775937ac9435e26ea818a550959535443398
SHA256

03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee
SHA512

7fd0690c9cfe7dd3033fe6af99a6a6bbad40c0fc347dd4f02866a98af0a03dc1b3602432b53a453a3fa684ad3669c760284e29bff7be09dcee9c5453a3fab824
SSDEEP

12288:/2LhQ2kWt0nFuaPPONSLVZaqRLPCKHt3ajJuB9/c8Rg63L363jLIgnIxm:/uC2WFzPXhZHPt3sJuTc8RgFb

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4292	csrss.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4264 set thread context of 4676	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2380	schtasks.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe:ZONE.identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Temp\csrss.exe\:ZONE.identifier:$DATA	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
Token: SeDebugPrivilege	4292	csrss.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 1184	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	89
PID 4264 wrote to memory of 1184	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	89
PID 4264 wrote to memory of 1184	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	89
PID 4264 wrote to memory of 2380	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	91
PID 4264 wrote to memory of 2380	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	91
PID 4264 wrote to memory of 2380	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	91
PID 4264 wrote to memory of 4676	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	93
PID 4264 wrote to memory of 4676	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	93
PID 4264 wrote to memory of 4676	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	93
PID 4264 wrote to memory of 4676	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	93
PID 4264 wrote to memory of 4676	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	93
PID 4264 wrote to memory of 4676	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	93
PID 4264 wrote to memory of 4676	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	93
PID 4264 wrote to memory of 4676	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	93
PID 4264 wrote to memory of 4676	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	93
PID 4264 wrote to memory of 4676	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	93
PID 4264 wrote to memory of 4292	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	94
PID 4264 wrote to memory of 4292	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	94
PID 4264 wrote to memory of 4292	4264	03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe	94

C:\Users\Admin\AppData\Local\Temp\03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
"C:\Users\Admin\AppData\Local\Temp\03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe":ZONE.identifier & exit
  2⤵
  - NTFS ADS
  PID:1184
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Windows" /XML "C:\Users\Admin\AppData\Local\Temp\88295669.xml"
  2⤵
  - Creates scheduled task(s)
  PID:2380
- C:\Users\Admin\AppData\Local\Temp\03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe
  "C:\Users\Admin\AppData\Local\Temp\03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Users\Admin\AppData\Local\Temp\csrss.exe
  "C:\Users\Admin\AppData\Local\Temp\csrss.exe" -prochide 4676
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe

Filesize
686KB

MD5
c4884c93e73f7af897b8a63e5fbcb555

SHA1
e933775937ac9435e26ea818a550959535443398

SHA256
03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee

SHA512
7fd0690c9cfe7dd3033fe6af99a6a6bbad40c0fc347dd4f02866a98af0a03dc1b3602432b53a453a3fa684ad3669c760284e29bff7be09dcee9c5453a3fab824

Download Submit
C:\Users\Admin\AppData\Local\Temp\03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee.exe

Filesize
686KB

MD5
c4884c93e73f7af897b8a63e5fbcb555

SHA1
e933775937ac9435e26ea818a550959535443398

SHA256
03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee

SHA512
7fd0690c9cfe7dd3033fe6af99a6a6bbad40c0fc347dd4f02866a98af0a03dc1b3602432b53a453a3fa684ad3669c760284e29bff7be09dcee9c5453a3fab824

Download Submit
C:\Users\Admin\AppData\Local\Temp\88295669.xml

Filesize
1KB

MD5
c713d4a6101e214754fce7e0f08be020

SHA1
9e0dd337d752d25125a53864dc2f1aaa9143fa1d

SHA256
a0b6bd05b7d4f7ea4e21425237ce9eecf3c58692d628c9e474af26dc02266270

SHA512
d4122d9c6ee25d56ac059f5002e307877b033c18ed16572dbc7923b667caca7788466ac0611679ed744242fd5c179f178d403e445d5d3fd964f9c7ce7d7a17d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss.exe

Filesize
686KB

MD5
c4884c93e73f7af897b8a63e5fbcb555

SHA1
e933775937ac9435e26ea818a550959535443398

SHA256
03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee

SHA512
7fd0690c9cfe7dd3033fe6af99a6a6bbad40c0fc347dd4f02866a98af0a03dc1b3602432b53a453a3fa684ad3669c760284e29bff7be09dcee9c5453a3fab824

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss.exe

Filesize
686KB

MD5
c4884c93e73f7af897b8a63e5fbcb555

SHA1
e933775937ac9435e26ea818a550959535443398

SHA256
03dfd925b116ae0e233d3f3f8f7c909a327b01f4709163614a394fedeed0fcee

SHA512
7fd0690c9cfe7dd3033fe6af99a6a6bbad40c0fc347dd4f02866a98af0a03dc1b3602432b53a453a3fa684ad3669c760284e29bff7be09dcee9c5453a3fab824

Download Submit
memory/4264-172-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/4264-132-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/4264-133-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/4292-173-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/4292-175-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/4676-152-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-163-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-149-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-150-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-151-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-147-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-153-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-155-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/4676-156-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-157-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-159-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-148-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-142-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-162-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-167-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-169-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-141-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-171-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-140-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-139-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-138-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/4676-174-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download
memory/4676-176-0x0000000074F40000-0x00000000754F1000-memory.dmp

Filesize
5.7MB

Download