60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05

Analysis

max time kernel
151s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe
Size

147KB
MD5

fb8f0df340477e8ab4707c835de9afc0
SHA1

8eef61dde9a91ebf76e458ce4963fd95aaeaab5e
SHA256

60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05
SHA512

cf4142f03c2b854975a48373377e0f2f11298fa31bc500281dd5a7ee3bb9dff1a93dc344c0634015e25d294faf29eb400f8d6c626483794d1491c51c8b3cf313
SSDEEP

3072:toUxlFYpz7gEHwIJTJ4bPTni2b4HuwIAhhJHydDM1+KNweG/5m1NEQXVTPrYskJD:mUxlFYpz7HHwI1J4bPTni2b4HuwIAhhW

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4360	NTKernel.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\NT Kernel\	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe
File created	C:\Windows\SysWOW64\NT Kernel\NTKernel.exe	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe
File opened for modification	C:\Windows\SysWOW64\NT Kernel\NTKernel.exe	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1512 set thread context of 4536	1512	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 4536	1512	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	86
PID 1512 wrote to memory of 4536	1512	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	86
PID 1512 wrote to memory of 4536	1512	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	86
PID 1512 wrote to memory of 4536	1512	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	86
PID 1512 wrote to memory of 4536	1512	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	86
PID 1512 wrote to memory of 4536	1512	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	86
PID 1512 wrote to memory of 4536	1512	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	86
PID 1512 wrote to memory of 4536	1512	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	86
PID 4536 wrote to memory of 4360	4536	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	93
PID 4536 wrote to memory of 4360	4536	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	93
PID 4536 wrote to memory of 4360	4536	60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe	93

C:\Users\Admin\AppData\Local\Temp\60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe
"C:\Users\Admin\AppData\Local\Temp\60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe
  "C:\Users\Admin\AppData\Local\Temp\60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05.exe"
  2⤵
  - Checks computer location settings
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\NT Kernel\NTKernel.exe
    "C:\Windows\system32\NT Kernel\NTKernel.exe"
    3⤵
    - Executes dropped EXE
    PID:4360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\NT Kernel\NTKernel.exe

Filesize
147KB

MD5
fb8f0df340477e8ab4707c835de9afc0

SHA1
8eef61dde9a91ebf76e458ce4963fd95aaeaab5e

SHA256
60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05

SHA512
cf4142f03c2b854975a48373377e0f2f11298fa31bc500281dd5a7ee3bb9dff1a93dc344c0634015e25d294faf29eb400f8d6c626483794d1491c51c8b3cf313

Download Submit
C:\Windows\SysWOW64\NT Kernel\NTKernel.exe

Filesize
147KB

MD5
fb8f0df340477e8ab4707c835de9afc0

SHA1
8eef61dde9a91ebf76e458ce4963fd95aaeaab5e

SHA256
60f7780b2b9cd891706d55bf191035695c57b24c143b907d2d9b1d0c14ea7e05

SHA512
cf4142f03c2b854975a48373377e0f2f11298fa31bc500281dd5a7ee3bb9dff1a93dc344c0634015e25d294faf29eb400f8d6c626483794d1491c51c8b3cf313

Download Submit
memory/1512-132-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Filesize
5.7MB

Download
memory/1512-133-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Filesize
5.7MB

Download
memory/1512-136-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Filesize
5.7MB

Download
memory/4360-141-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Filesize
5.7MB

Download
memory/4536-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4536-137-0x00000000748F0000-0x0000000074EA1000-memory.dmp

Filesize
5.7MB

Download