Analysis
-
max time kernel
173s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 06:46
Static task
static1
Behavioral task
behavioral1
Sample
405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe
Resource
win10v2004-20221111-en
General
-
Target
405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe
-
Size
1.3MB
-
MD5
f721d46e0049e7604741f53f79fe39a3
-
SHA1
2bb22da15b74e26de1ffecb81583c403f1893257
-
SHA256
405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119
-
SHA512
89bcac2c72bddc50922381b0a92dcda4a1c2ee26dd8830393a983c19f804096792aa404ff786d5cc7928cae77c448c398c4606b6f869951f92e32931a933cfe3
-
SSDEEP
24576:R0FGMqzFkMiE4nAcQB2kWf65NShgDAzkxFPh3kEpS:e+Fk+MHn6/SKDIkxxh3
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 1 IoCs
Processes:
theYNC.com.exepid process 3076 theYNC.com.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "\"\"" 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exedescription pid process target process PID 732 set thread context of 4544 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe Cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exepid process 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exedescription pid process Token: SeDebugPrivilege 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exedescription pid process target process PID 732 wrote to memory of 3076 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe theYNC.com.exe PID 732 wrote to memory of 3076 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe theYNC.com.exe PID 732 wrote to memory of 4544 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe Cvtres.exe PID 732 wrote to memory of 4544 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe Cvtres.exe PID 732 wrote to memory of 4544 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe Cvtres.exe PID 732 wrote to memory of 4544 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe Cvtres.exe PID 732 wrote to memory of 4544 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe Cvtres.exe PID 732 wrote to memory of 4544 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe Cvtres.exe PID 732 wrote to memory of 4544 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe Cvtres.exe PID 732 wrote to memory of 4544 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe Cvtres.exe PID 732 wrote to memory of 4544 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe Cvtres.exe PID 732 wrote to memory of 4544 732 405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe Cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe"C:\Users\Admin\AppData\Local\Temp\405038bb905e5740fb8363dfdc8b03a7d40d7ea80715bb5697a65a0fbcd45119.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\theYNC.com.exe"C:\Users\Admin\AppData\Local\Temp\theYNC.com.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Cvtres.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\Cvtres.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\theYNC.com.exeFilesize
245KB
MD5f356cb1e06242e5f221aa20cf33a044a
SHA175715369757ea20f51791a4c5fb3e6daf407611a
SHA256648cfca36bcd7ad8ae0cb623a7edf04196b7490eebec364b586fb37428214f96
SHA512cd6673482fa6c7d0070f54d53932781a8e27537cd18b067488b607d3f3cb88c88754e5f3ec499b207ef210ca0e3e4b687a7a9eb09fe11f0123ed5b0742aa5a34
-
C:\Users\Admin\AppData\Local\Temp\theYNC.com.exeFilesize
245KB
MD5f356cb1e06242e5f221aa20cf33a044a
SHA175715369757ea20f51791a4c5fb3e6daf407611a
SHA256648cfca36bcd7ad8ae0cb623a7edf04196b7490eebec364b586fb37428214f96
SHA512cd6673482fa6c7d0070f54d53932781a8e27537cd18b067488b607d3f3cb88c88754e5f3ec499b207ef210ca0e3e4b687a7a9eb09fe11f0123ed5b0742aa5a34
-
memory/732-132-0x0000000074E50000-0x0000000075401000-memory.dmpFilesize
5.7MB
-
memory/732-143-0x0000000074E50000-0x0000000075401000-memory.dmpFilesize
5.7MB
-
memory/3076-133-0x0000000000000000-mapping.dmp
-
memory/3076-142-0x000000001C650000-0x000000001D086000-memory.dmpFilesize
10.2MB
-
memory/4544-136-0x0000000000000000-mapping.dmp
-
memory/4544-137-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4544-139-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4544-140-0x0000000000400000-0x00000000004EEB38-memory.dmpFilesize
954KB
-
memory/4544-141-0x0000000000A00000-0x0000000000AE0000-memory.dmpFilesize
896KB