7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07

General

Target

7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe
Size

92KB
MD5

31235ae9502be65fd5c482d6df1fd46f
SHA1

40e5d08545af0e3e0858bedfbfc4dfa2eec8290c
SHA256

7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07
SHA512

d4723bc532083c495f3c1c8207c3e090ae0fcef50e8e93d1a621d3d310b57a954cceea855382ceaf2affc1987055cdc00c4818a92681800ea103cb3e77dc983e
SSDEEP

1536:yIM1yFwNHOcPNMt16a06VxDrIak9K0oBDPrzKJ:yZMtkgVxD708jzKJ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4636	taskhost.exe
4840	taskhost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mainsyssvcs = "\"C:\\windows\\taskhost.exe\""	taskhost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4828 set thread context of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 4636 set thread context of 4840	4636	taskhost.exe	90

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\taskhost.exe	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe
File opened for modification	\??\c:\windows\taskhost.exe	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 4828 wrote to memory of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 4828 wrote to memory of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 4828 wrote to memory of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 4828 wrote to memory of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 4828 wrote to memory of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 4828 wrote to memory of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 4828 wrote to memory of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 4828 wrote to memory of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 4828 wrote to memory of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 4828 wrote to memory of 2248	4828	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	80
PID 2248 wrote to memory of 4636	2248	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	81
PID 2248 wrote to memory of 4636	2248	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	81
PID 2248 wrote to memory of 4636	2248	7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe	81
PID 4636 wrote to memory of 4840	4636	taskhost.exe	90
PID 4636 wrote to memory of 4840	4636	taskhost.exe	90
PID 4636 wrote to memory of 4840	4636	taskhost.exe	90
PID 4636 wrote to memory of 4840	4636	taskhost.exe	90
PID 4636 wrote to memory of 4840	4636	taskhost.exe	90
PID 4636 wrote to memory of 4840	4636	taskhost.exe	90
PID 4636 wrote to memory of 4840	4636	taskhost.exe	90
PID 4636 wrote to memory of 4840	4636	taskhost.exe	90
PID 4636 wrote to memory of 4840	4636	taskhost.exe	90
PID 4636 wrote to memory of 4840	4636	taskhost.exe	90
PID 4636 wrote to memory of 4840	4636	taskhost.exe	90

C:\Users\Admin\AppData\Local\Temp\7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe
"C:\Users\Admin\AppData\Local\Temp\7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe
  "C:\Users\Admin\AppData\Local\Temp\7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\windows\taskhost.exe
    "C:\windows\taskhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\windows\taskhost.exe
      "C:\windows\taskhost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:4840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\taskhost.exe

Filesize
92KB

MD5
31235ae9502be65fd5c482d6df1fd46f

SHA1
40e5d08545af0e3e0858bedfbfc4dfa2eec8290c

SHA256
7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07

SHA512
d4723bc532083c495f3c1c8207c3e090ae0fcef50e8e93d1a621d3d310b57a954cceea855382ceaf2affc1987055cdc00c4818a92681800ea103cb3e77dc983e

Download Submit
C:\Windows\taskhost.exe

Filesize
92KB

MD5
31235ae9502be65fd5c482d6df1fd46f

SHA1
40e5d08545af0e3e0858bedfbfc4dfa2eec8290c

SHA256
7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07

SHA512
d4723bc532083c495f3c1c8207c3e090ae0fcef50e8e93d1a621d3d310b57a954cceea855382ceaf2affc1987055cdc00c4818a92681800ea103cb3e77dc983e

Download Submit
C:\windows\taskhost.exe

Filesize
92KB

MD5
31235ae9502be65fd5c482d6df1fd46f

SHA1
40e5d08545af0e3e0858bedfbfc4dfa2eec8290c

SHA256
7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07

SHA512
d4723bc532083c495f3c1c8207c3e090ae0fcef50e8e93d1a621d3d310b57a954cceea855382ceaf2affc1987055cdc00c4818a92681800ea103cb3e77dc983e

Download Submit
memory/2248-132-0x0000000000000000-mapping.dmp

Download
memory/2248-133-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2248-135-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2248-139-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4636-136-0x0000000000000000-mapping.dmp

Download
memory/4840-140-0x0000000000000000-mapping.dmp

Download
memory/4840-144-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4840-145-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing