Analysis
-
max time kernel
208s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 23:40
Static task
static1
Behavioral task
behavioral1
Sample
36858bb18574315047429775c5bdca18.exe
Resource
win7-20221111-en
General
-
Target
36858bb18574315047429775c5bdca18.exe
-
Size
1.0MB
-
MD5
36858bb18574315047429775c5bdca18
-
SHA1
ebb242dcb189f0501f2631324af21eca9b7094a1
-
SHA256
5eab382b9338d93188634d7f10e192a9fe644753910f4a65c483ba76d440f133
-
SHA512
9d12738740fe779850a64c3e987eec32e105d7d464d9bdabe2fb124417d2fdbc955eb841b8161efdccb7fb1c66d58b1a56feca50699990499a6e77d12a0f4e8d
-
SSDEEP
12288:aSZIKqGtTfNuvWUYVoMkta4rHAnaNNZit1MU2adY+IcL1Nz0M4J7jl9Qg:acIEfNNUYVoMq1gaNnI4aV1yM4JrJ
Malware Config
Extracted
formbook
pgnt
0WG18LbM4lR9iqMRa4nlBzTb
jcfGYzPgZTqFZVO9FV2yIw==
laIfrdSC8/4CNg==
Q73ilev5GIWuOrAAFV2yIw==
Q2u/pMw7pv4sPA==
TbqvIUHwlQscPo0HFV2yIw==
8PNWfGPyE8n0IQ==
WtgROxXzvY2L
PryaRBNjm4eP
Y9Hdi06Cry1um9Sj68YAu1o=
3Gulyp7CMQtR78jvLkk=
JJ3GasTVTCRQT6Tfz6S6GlI=
RnS42bhb9tI0R6UpD6wOxriNxw==
he1mi2sOGfzTRGHnuA==
eaYjCtjxVjdU5XLRtBMBLKk9quA=
k9rTeEqYzzw8WaTfz6S6GlI=
5luVQwe2vJWKEAiMdF4=
MGW14L9OVk5Y5TaR6w/DqdhYxXVY
mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==
y5klhuMbE8n0IQ==
u/NKcEKARatNn/dT
ZJaHJQCvzDWRuPPmMsEVxriNxw==
nRhddlcPOegWrv5R
/njA0TJ1U+osPA==
pi8az6AySKlNn/dT
e/k+YjN+U+osPA==
kMAZ36lMWa3gRGHnuA==
wfX0nGsGE1yUJb1Jq33LoDdDWLSgFQ==
wfk35UJcfeHoRGHnuA==
dbzljekZ3ka2QYCYOP1I
Nq3kDeMNNJWDMnWYOP1I
Sa0SN/04cNje8xbaJLgUxriNxw==
yDejyZiQ/X/BQYiYOP1I
UIPN7ckznp2W
s/HtqJNKdmtv88jvLkk=
KanG2bhM0CsdiNrNF0E=
QLrtp3svzjcsTaJ9y5kPopyQzQ==
syhbC2iJZ8obK2Y7nHSa7CmdUuA=
HZXK676zo5OV
5WFoCWeuxqekcHx5YkE=
PbX1H/gmE8n0IQ==
3HTB6Asznp2W
9HGhWLLyrJXPcq4FRecyGU247XBS
/oW437jofmJ8DQiMdF4=
sh415lJ8q3cL3XJvaEA=
XucfBGWzVEg=
PKWeQgpB1cUHprue4sYAu1o=
MXFzDmuO/nBtmjc6g5elIVMbQeWFjyMN
q+v2lgI9Vb0rC2juug==
WYvkDdX8kEjU73U=
6BJjmWGiizGT
fLHageH29Ex1m8jvLkk=
3D+hsVkFtIyr5WI=
ntIbRgolp0jU73U=
GGGJMpC3pJPdQ8ZGkpxA
8FtjHvNDiICP
L63yFOor5uMdLqnrNNblBzTb
Gav/MgU4AByfuddW
xek7Tm3lhlY=
n2sDng5BBdtNn/dT
LZsINfoQH6dNn/dT
Io+SQh7ak0Ti7Gg=
T8Xci1oCP63aRGHnuA==
bZX0DnWMqxcyQ39hzOH+7U0BvmhP
hf9blwwuwpx7j8k.live
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
36858bb18574315047429775c5bdca18.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 36858bb18574315047429775c5bdca18.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
36858bb18574315047429775c5bdca18.exedescription pid process target process PID 1932 set thread context of 4724 1932 36858bb18574315047429775c5bdca18.exe 36858bb18574315047429775c5bdca18.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exe36858bb18574315047429775c5bdca18.exepid process 4472 powershell.exe 4724 36858bb18574315047429775c5bdca18.exe 4724 36858bb18574315047429775c5bdca18.exe 4472 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4472 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
36858bb18574315047429775c5bdca18.exedescription pid process target process PID 1932 wrote to memory of 4472 1932 36858bb18574315047429775c5bdca18.exe powershell.exe PID 1932 wrote to memory of 4472 1932 36858bb18574315047429775c5bdca18.exe powershell.exe PID 1932 wrote to memory of 4472 1932 36858bb18574315047429775c5bdca18.exe powershell.exe PID 1932 wrote to memory of 4304 1932 36858bb18574315047429775c5bdca18.exe schtasks.exe PID 1932 wrote to memory of 4304 1932 36858bb18574315047429775c5bdca18.exe schtasks.exe PID 1932 wrote to memory of 4304 1932 36858bb18574315047429775c5bdca18.exe schtasks.exe PID 1932 wrote to memory of 4724 1932 36858bb18574315047429775c5bdca18.exe 36858bb18574315047429775c5bdca18.exe PID 1932 wrote to memory of 4724 1932 36858bb18574315047429775c5bdca18.exe 36858bb18574315047429775c5bdca18.exe PID 1932 wrote to memory of 4724 1932 36858bb18574315047429775c5bdca18.exe 36858bb18574315047429775c5bdca18.exe PID 1932 wrote to memory of 4724 1932 36858bb18574315047429775c5bdca18.exe 36858bb18574315047429775c5bdca18.exe PID 1932 wrote to memory of 4724 1932 36858bb18574315047429775c5bdca18.exe 36858bb18574315047429775c5bdca18.exe PID 1932 wrote to memory of 4724 1932 36858bb18574315047429775c5bdca18.exe 36858bb18574315047429775c5bdca18.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36858bb18574315047429775c5bdca18.exe"C:\Users\Admin\AppData\Local\Temp\36858bb18574315047429775c5bdca18.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HRlyZTYWzC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HRlyZTYWzC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBCB4.tmp"2⤵
- Creates scheduled task(s)
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\36858bb18574315047429775c5bdca18.exe"C:\Users\Admin\AppData\Local\Temp\36858bb18574315047429775c5bdca18.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBCB4.tmpFilesize
1KB
MD5237efb7c823d6e64917263fd58a09e1e
SHA18f29ca756f4711401f13d6c396f80029fed9a77b
SHA256e04d99673df6eb14b3e09f10ff3da46d76927a68db026386b3e290a1402f3811
SHA51281095d2fabc5d3fac4dd43f6e5187224d4d43dac776ae9a46f202384f9bd1bcb41462962b2b9f7aa606d73da047fa87680dfb9e3b3455eb15163ae6f7933735f
-
memory/1932-133-0x0000000005B00000-0x00000000060A4000-memory.dmpFilesize
5.6MB
-
memory/1932-134-0x0000000005550000-0x00000000055E2000-memory.dmpFilesize
584KB
-
memory/1932-135-0x00000000054F0000-0x00000000054FA000-memory.dmpFilesize
40KB
-
memory/1932-136-0x0000000009340000-0x00000000093DC000-memory.dmpFilesize
624KB
-
memory/1932-132-0x0000000000A50000-0x0000000000B58000-memory.dmpFilesize
1.0MB
-
memory/4304-138-0x0000000000000000-mapping.dmp
-
memory/4472-147-0x0000000005AA0000-0x0000000005B06000-memory.dmpFilesize
408KB
-
memory/4472-151-0x00000000060A0000-0x00000000060BE000-memory.dmpFilesize
120KB
-
memory/4472-141-0x0000000005170000-0x0000000005798000-memory.dmpFilesize
6.2MB
-
memory/4472-161-0x00000000076E0000-0x00000000076E8000-memory.dmpFilesize
32KB
-
memory/4472-160-0x0000000007700000-0x000000000771A000-memory.dmpFilesize
104KB
-
memory/4472-145-0x0000000005820000-0x0000000005842000-memory.dmpFilesize
136KB
-
memory/4472-146-0x00000000059C0000-0x0000000005A26000-memory.dmpFilesize
408KB
-
memory/4472-137-0x0000000000000000-mapping.dmp
-
memory/4472-159-0x00000000075F0000-0x00000000075FE000-memory.dmpFilesize
56KB
-
memory/4472-158-0x0000000007640000-0x00000000076D6000-memory.dmpFilesize
600KB
-
memory/4472-157-0x0000000007430000-0x000000000743A000-memory.dmpFilesize
40KB
-
memory/4472-139-0x0000000004B00000-0x0000000004B36000-memory.dmpFilesize
216KB
-
memory/4472-152-0x0000000007280000-0x00000000072B2000-memory.dmpFilesize
200KB
-
memory/4472-153-0x0000000070E40000-0x0000000070E8C000-memory.dmpFilesize
304KB
-
memory/4472-154-0x0000000006680000-0x000000000669E000-memory.dmpFilesize
120KB
-
memory/4472-155-0x0000000007A00000-0x000000000807A000-memory.dmpFilesize
6.5MB
-
memory/4472-156-0x00000000073C0000-0x00000000073DA000-memory.dmpFilesize
104KB
-
memory/4724-150-0x00000000017A0000-0x0000000001AEA000-memory.dmpFilesize
3.3MB
-
memory/4724-149-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4724-148-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4724-143-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4724-142-0x0000000000000000-mapping.dmp