1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1

General

Target

1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe
Size

151KB
MD5

ae94b23012157c6c7205b8428466fd47
SHA1

b630a8f7ee8806263b2abe5b0a0884ecf2193ba5
SHA256

1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1
SHA512

c828f741706e9a3f5c2772e1f8e217718e7ed4d54bf1bd55b61bb29b96ae1a668362e031252184b9898e9f6ed8a9d78aaaf2dd0bda05fc4a2f615f32fae27fb6
SSDEEP

3072:sLANnN/I9YHmMxd55YjB+4GSvquAJvJDsuMqd:sLANnq983vS5AN5t

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4828	svhst.exe
4764	svhst.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\run = "C:\\Users\\Admin\\AppData\\Roaming\\test\\svhst.exe"	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4828 set thread context of 4764	4828	svhst.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1692	4764	WerFault.exe	83
4040	4828	WerFault.exe	80
2272	4764	WerFault.exe	83

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1168	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe
4828	svhst.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 4828	1168	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe	80
PID 1168 wrote to memory of 4828	1168	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe	80
PID 1168 wrote to memory of 4828	1168	1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe	80
PID 4828 wrote to memory of 4764	4828	svhst.exe	83
PID 4828 wrote to memory of 4764	4828	svhst.exe	83
PID 4828 wrote to memory of 4764	4828	svhst.exe	83
PID 4828 wrote to memory of 4764	4828	svhst.exe	83
PID 4828 wrote to memory of 4764	4828	svhst.exe	83
PID 4828 wrote to memory of 4764	4828	svhst.exe	83
PID 4828 wrote to memory of 4764	4828	svhst.exe	83
PID 4828 wrote to memory of 4764	4828	svhst.exe	83
PID 4828 wrote to memory of 4764	4828	svhst.exe	83

C:\Users\Admin\AppData\Local\Temp\1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe
"C:\Users\Admin\AppData\Local\Temp\1777653d60edd3e15c0670e99b2fa0d7efed3400614e59b3036b1196d67198d1.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Roaming\test\svhst.exe
  "C:\Users\Admin\AppData\Roaming\test\svhst.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Users\Admin\AppData\Roaming\test\svhst.exe
    "C:\Users\Admin\AppData\Roaming\test\svhst.exe"
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 180
      4⤵
      Program crash
      PID:1692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 184
      4⤵
      Program crash
      PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 780
    3⤵
    - Program crash
    PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4828 -ip 4828
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4764 -ip 4764
1⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4764 -ip 4764
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
C:\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
C:\Users\Admin\AppData\Roaming\test\svhst.exe

Filesize
151KB

MD5
e8c3557fad4cb5036c931301b0dcb171

SHA1
f145b92cbeb588b18c1a7784f566eba89e7dc97a

SHA256
38af47e3d3304ff9448b51a214883f8347d3802d7f677ff43374c3ef046a8706

SHA512
bf7c2cb74e7c469d51f7c025701223cdaaa1813243843e07186ff1675c9df8b5bf1ef1626fa15e9cbc96ab456e7797162517d42de198112c910b3a2279c7ddc3

Download Submit
memory/1168-134-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/4764-141-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing