9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe
Size

458KB
MD5

e623e316461a5179f70fe8ceba7d0ad4
SHA1

19d00d96b16822e1b76fa5ee890389b8a0238d6d
SHA256

9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b
SHA512

fc48297f187a33c6d1ac03ae8daa8c0fe55ac33dc46680c0f406bd8eef0046f4961ddcafd8c1ca208ffad4adfca37c6abdd6b40221594836c6016d0dd825fd5b
SSDEEP

12288:TUWA3AheuswyemhdS36N0eenbTdW8AgAXTp12gkM:TUWqiste9KDebT48AgqTp1f

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4500	svchost.exe
560	csrss.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe
4500	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4500	4464	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	79
PID 4464 wrote to memory of 4500	4464	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	79
PID 4464 wrote to memory of 4500	4464	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	79
PID 4464 wrote to memory of 560	4464	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	80
PID 4464 wrote to memory of 560	4464	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	80
PID 4464 wrote to memory of 560	4464	9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe	80

C:\Users\Admin\AppData\Local\Temp\9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe
"C:\Users\Admin\AppData\Local\Temp\9703448cde8d84c2039bbccac361a939f3658eb080fa9f5873870bcb3717969b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Common Files\Microsoft\svchost.exe
  "C:\Common Files\Microsoft\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Common Files\Microsoft\csrss.exe
  "C:\Common Files\Microsoft\csrss.exe"
  2⤵
  - Executes dropped EXE
  PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Common Files\Microsoft\csrss.exe

Filesize
803KB

MD5
7a7fc6cd4fea870bb949140a9fea0cc2

SHA1
dcd3bcae577768946be983aa6137f703d798d780

SHA256
39a25e75a868a941f47e4bceac961f5d939ccb5dee44952d4f1f913ff45697a7

SHA512
dfeeb08e9aed003e3af315972fd73eab7305e0a3f41c77b08fd093aa8b0909f8303a37c6bd624071fc780752945b8dfeb2c075d302649c4e93ca81631a0aa61d

Download Submit
C:\Common Files\Microsoft\csrss.exe

Filesize
803KB

MD5
7a7fc6cd4fea870bb949140a9fea0cc2

SHA1
dcd3bcae577768946be983aa6137f703d798d780

SHA256
39a25e75a868a941f47e4bceac961f5d939ccb5dee44952d4f1f913ff45697a7

SHA512
dfeeb08e9aed003e3af315972fd73eab7305e0a3f41c77b08fd093aa8b0909f8303a37c6bd624071fc780752945b8dfeb2c075d302649c4e93ca81631a0aa61d

Download Submit
C:\Common Files\Microsoft\svchost.exe

Filesize
197KB

MD5
487382271e1d6fb8f817f3187741d5ad

SHA1
356a5b6ed799f98a0c4001ec673cac34fbe25a79

SHA256
717384f1ff3be86431f339abb298ccdce69a32129ef8ecf4840c69e19ceef72b

SHA512
0527819981e4753e2a7db269d4bab7f19523fd0e0585c7379a7971cf2243b2ebde770142760b129da5ab76ddf41d5b4c06d24c51355714e5f1e1d12635259fa7

Download Submit
C:\Common Files\Microsoft\svchost.exe

Filesize
197KB

MD5
487382271e1d6fb8f817f3187741d5ad

SHA1
356a5b6ed799f98a0c4001ec673cac34fbe25a79

SHA256
717384f1ff3be86431f339abb298ccdce69a32129ef8ecf4840c69e19ceef72b

SHA512
0527819981e4753e2a7db269d4bab7f19523fd0e0585c7379a7971cf2243b2ebde770142760b129da5ab76ddf41d5b4c06d24c51355714e5f1e1d12635259fa7

Download Submit
memory/4500-138-0x0000000072870000-0x0000000072E21000-memory.dmp

Filesize
5.7MB

Download
memory/4500-139-0x0000000072870000-0x0000000072E21000-memory.dmp

Filesize
5.7MB

Download