Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 09:43
Static task
static1
Behavioral task
behavioral1
Sample
a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe
Resource
win10v2004-20220812-en
General
-
Target
a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe
-
Size
880KB
-
MD5
dc993f2bde7c48504df0a30ed3095b4a
-
SHA1
a9f030695570274d680c187a133473812e277de4
-
SHA256
a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f
-
SHA512
ed82e1fb3aa02b4c633ece17bbe2a5b419e1e7d63abbff662806d62b3d4d8336244f1669938f3459c72d82682c9e56a18da3000453db85b1b3934beaaf003760
-
SSDEEP
6144:WmERrvsi0oAtnm2cbNrQXL5hevs8OwYP6PG2hTSk9FKrcSPCXiM8kWUXqTlr3fFo:WmSitm2cRg2R9F+cUBYIiYV9XBcZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MFMKD.exepid process 4776 MFMKD.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MFMKD.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation MFMKD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3028 4776 WerFault.exe MFMKD.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2444 timeout.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeMFMKD.exepid process 4320 powershell.exe 4320 powershell.exe 4752 powershell.exe 4752 powershell.exe 4072 powershell.exe 1044 powershell.exe 1044 powershell.exe 4072 powershell.exe 4776 MFMKD.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exepowershell.exepowershell.exeMFMKD.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3524 a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeDebugPrivilege 4752 powershell.exe Token: SeDebugPrivilege 4776 MFMKD.exe Token: SeDebugPrivilege 4072 powershell.exe Token: SeDebugPrivilege 1044 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.execmd.exeMFMKD.execmd.exedescription pid process target process PID 3524 wrote to memory of 4320 3524 a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe powershell.exe PID 3524 wrote to memory of 4320 3524 a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe powershell.exe PID 3524 wrote to memory of 4752 3524 a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe powershell.exe PID 3524 wrote to memory of 4752 3524 a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe powershell.exe PID 3524 wrote to memory of 2200 3524 a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe cmd.exe PID 3524 wrote to memory of 2200 3524 a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe cmd.exe PID 2200 wrote to memory of 2444 2200 cmd.exe timeout.exe PID 2200 wrote to memory of 2444 2200 cmd.exe timeout.exe PID 2200 wrote to memory of 4776 2200 cmd.exe MFMKD.exe PID 2200 wrote to memory of 4776 2200 cmd.exe MFMKD.exe PID 4776 wrote to memory of 4072 4776 MFMKD.exe powershell.exe PID 4776 wrote to memory of 4072 4776 MFMKD.exe powershell.exe PID 4776 wrote to memory of 1044 4776 MFMKD.exe powershell.exe PID 4776 wrote to memory of 1044 4776 MFMKD.exe powershell.exe PID 4776 wrote to memory of 4580 4776 MFMKD.exe cmd.exe PID 4776 wrote to memory of 4580 4776 MFMKD.exe cmd.exe PID 4580 wrote to memory of 3640 4580 cmd.exe schtasks.exe PID 4580 wrote to memory of 3640 4580 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe"C:\Users\Admin\AppData\Local\Temp\a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6B51.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\ProgramData\APPDATA\MFMKD.exe"C:\ProgramData\APPDATA\MFMKD.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "MFMKD" /tr "C:\ProgramData\APPDATA\MFMKD.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "MFMKD" /tr "C:\ProgramData\APPDATA\MFMKD.exe"5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4776 -s 21404⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 4776 -ip 47761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\APPDATA\MFMKD.exeFilesize
880KB
MD5dc993f2bde7c48504df0a30ed3095b4a
SHA1a9f030695570274d680c187a133473812e277de4
SHA256a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f
SHA512ed82e1fb3aa02b4c633ece17bbe2a5b419e1e7d63abbff662806d62b3d4d8336244f1669938f3459c72d82682c9e56a18da3000453db85b1b3934beaaf003760
-
C:\ProgramData\APPDATA\MFMKD.exeFilesize
880KB
MD5dc993f2bde7c48504df0a30ed3095b4a
SHA1a9f030695570274d680c187a133473812e277de4
SHA256a53f236cc47d299313d491db76261e2f3ac83b0bc0f469175a6591830836281f
SHA512ed82e1fb3aa02b4c633ece17bbe2a5b419e1e7d63abbff662806d62b3d4d8336244f1669938f3459c72d82682c9e56a18da3000453db85b1b3934beaaf003760
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD510890cda4b6eab618e926c4118ab0647
SHA11e1d63b73a0e6c7575f458b3c7917a9ce5ba776d
SHA25600f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14
SHA512a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221
-
C:\Users\Admin\AppData\Local\Temp\tmp6B51.tmp.batFilesize
141B
MD5941992af18047b213934e5d30a1b2d5d
SHA14c90c469d82a9c624e2534506461b1a0ce8c78fe
SHA2565f020de55072c24981ffabd5b64b8e7646ff9bb0c009f7564da04105f78f0a35
SHA5120bdc75c64289d88e557996a13ea7852f076364eb93bd5a20ebc54fd8ea1cf1c7569d13ac9a5fdb70316b0be8aba2f2c9832d12d1ff3258481cfacb992dc9c2bb
-
memory/1044-148-0x0000000000000000-mapping.dmp
-
memory/1044-156-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB
-
memory/1044-151-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB
-
memory/2200-135-0x0000000000000000-mapping.dmp
-
memory/2444-138-0x0000000000000000-mapping.dmp
-
memory/3524-142-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB
-
memory/3524-132-0x0000000000150000-0x0000000000230000-memory.dmpFilesize
896KB
-
memory/3640-154-0x0000000000000000-mapping.dmp
-
memory/4072-150-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB
-
memory/4072-157-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB
-
memory/4072-147-0x0000000000000000-mapping.dmp
-
memory/4320-137-0x0000014382400000-0x0000014382422000-memory.dmpFilesize
136KB
-
memory/4320-141-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB
-
memory/4320-133-0x0000000000000000-mapping.dmp
-
memory/4320-158-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB
-
memory/4580-152-0x0000000000000000-mapping.dmp
-
memory/4752-143-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB
-
memory/4752-134-0x0000000000000000-mapping.dmp
-
memory/4776-149-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB
-
memory/4776-144-0x0000000000000000-mapping.dmp
-
memory/4776-159-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB
-
memory/4776-160-0x00007FF963CA0000-0x00007FF964761000-memory.dmpFilesize
10.8MB