9e866e6389c9d36f943f9cb9c7d86f1b6f332dc4e12cccf24a40597df4ca9b11

Analysis

max time kernel
80s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9e866e6389c9d36f943f9cb9c7d86f1b6f332dc4e12cccf24a40597df4ca9b11.exe
Size

274KB
MD5

aa56e5691d75776e68b6b2f860eb3cca
SHA1

11cf6535b217e2f73e0433fdadcdfd3ef0923513
SHA256

9e866e6389c9d36f943f9cb9c7d86f1b6f332dc4e12cccf24a40597df4ca9b11
SHA512

3c84ca5fcb6fb3313d6c332af788a8277a4c71526a3ec75c32539434798af0802af94b999cbdbcdcebaf2acc485ea95728e2fee5ee6f84f6f7e8380dca42d89e
SSDEEP

6144:ysaocyLC0cZIgFtJzNhXgDh82eRmHPyIgYSjsJ+LjMdkly2hD:ytobLEJzNVgsRgsYYvMCEo

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3248	installer.exe
816	4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	installer.exe

Loads dropped DLL 1 IoCs

pid	Process
944	9e866e6389c9d36f943f9cb9c7d86f1b6f332dc4e12cccf24a40597df4ca9b11.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	installer.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	installer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	installer.exe
File created	C:\Windows\assembly\Desktop.ini	installer.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60103000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 5c000000010000000400000000080000190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b817e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8122000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	installer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
816	4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe
816	4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 3248	944	9e866e6389c9d36f943f9cb9c7d86f1b6f332dc4e12cccf24a40597df4ca9b11.exe	79
PID 944 wrote to memory of 3248	944	9e866e6389c9d36f943f9cb9c7d86f1b6f332dc4e12cccf24a40597df4ca9b11.exe	79
PID 944 wrote to memory of 3248	944	9e866e6389c9d36f943f9cb9c7d86f1b6f332dc4e12cccf24a40597df4ca9b11.exe	79
PID 3248 wrote to memory of 816	3248	installer.exe	81
PID 3248 wrote to memory of 816	3248	installer.exe	81
PID 3248 wrote to memory of 816	3248	installer.exe	81

C:\Users\Admin\AppData\Local\Temp\9e866e6389c9d36f943f9cb9c7d86f1b6f332dc4e12cccf24a40597df4ca9b11.exe
"C:\Users\Admin\AppData\Local\Temp\9e866e6389c9d36f943f9cb9c7d86f1b6f332dc4e12cccf24a40597df4ca9b11.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\nsu6D8.tmp\installer.exe
  C:\Users\Admin\AppData\Local\Temp\nsu6D8.tmp\installer.exe 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe /t /dT131921401S /e5818302 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Users\Admin\AppData\Local\Temp\nsu6D8.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe
    "C:\Users\Admin\AppData\Local\Temp\nsu6D8.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe" /t /dT131921401S /e5818302 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EDCF682921FE94F4A02A43CD1A28E6B

Filesize
604B

MD5
e7ed9b0571e14a4824cebee137d9bcd1

SHA1
59d9a27a741aee4bfc0605a287a88782cdafe6ff

SHA256
62f9b298a1f9e62f29c486f9cd2731a28302b9215656fd8b1c7c0071071b25ad

SHA512
6f6f379a5fbce3afbfb29b159bfe784ecf4b42672c5bc441e89383c54ccd210766388526748c48f9889cfdd5e126054a8d67971d69c46f37bb117e515ad9d400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EDCF682921FE94F4A02A43CD1A28E6B

Filesize
188B

MD5
39a7a48d9079c5017b48dc7019ee32c4

SHA1
968fa514efb96391de083dd951e11d3ed1bf56d0

SHA256
6fe1e2ad8b69369f95d47e8b828e4f2a4ec59d1001d5fe020e26f5d5df09a083

SHA512
e63fb4d57ee5a111fe7637bcfadb08b63125af30c38da3d4b61f8b85f967c9de3c3495cc536cd20c259d0deadec701043ca10df4994534837e4bcd4097b38cea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

Filesize
404B

MD5
12d31fcd1a57e58e07cf82b010fa6855

SHA1
dfb861d68c25ba7dc0c31b57468fb0d268381398

SHA256
3ed66b157572d311c516cf4d96e8b58fa5e75bcd96b7ee07fa8241da60460811

SHA512
8d2791d3eaa9347c92a4dc472b9f4271cbbb408972645c9dddaeb5b1acbe5c9232b25945acfa1502bc7c0c3fe1c26e6e87418f6373fe81688fbab5bdca96e43f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6D8.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe

Filesize
256KB

MD5
6e68cf541f031c7de9da6ec8d86862aa

SHA1
115f143b5f585a27006159dc1b2d4d23a7af5295

SHA256
d1763b911eebce060a4c479190e83ff5747f5e75f938fb1cb23d5fcaba249e35

SHA512
022af872f2343293a0d71c6cc3ca3f13001ce7ad8e04cf740b75574272cad1dcb40a97a0e860082e7080a69a0367438728f1983317349d5a33ca969c3d877de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6D8.tmp\4fe0cf9f-1fe4-4abb-905a-57915bc06f2f.exe

Filesize
256KB

MD5
6e68cf541f031c7de9da6ec8d86862aa

SHA1
115f143b5f585a27006159dc1b2d4d23a7af5295

SHA256
d1763b911eebce060a4c479190e83ff5747f5e75f938fb1cb23d5fcaba249e35

SHA512
022af872f2343293a0d71c6cc3ca3f13001ce7ad8e04cf740b75574272cad1dcb40a97a0e860082e7080a69a0367438728f1983317349d5a33ca969c3d877de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6D8.tmp\installer.exe

Filesize
214KB

MD5
7cf3bce5ecf2aea97b49e2eba8ca0aba

SHA1
543f5fc23df08f946488d27b2fb16b13b6311d1a

SHA256
7358afae03a24b31c0d82ee4e5fd2f17cafe6c3bdd8e26326aa4118f2169f736

SHA512
5f9184189940af27e25ae2988db8d15923dac81b2410c5fe3287f126fb50df43735fccb4e4d9f376e9f24700604c157aa1828622dab54014d9583a56ab698d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6D8.tmp\installer.exe

Filesize
214KB

MD5
7cf3bce5ecf2aea97b49e2eba8ca0aba

SHA1
543f5fc23df08f946488d27b2fb16b13b6311d1a

SHA256
7358afae03a24b31c0d82ee4e5fd2f17cafe6c3bdd8e26326aa4118f2169f736

SHA512
5f9184189940af27e25ae2988db8d15923dac81b2410c5fe3287f126fb50df43735fccb4e4d9f376e9f24700604c157aa1828622dab54014d9583a56ab698d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6D8.tmp\nsExec.dll

Filesize
8KB

MD5
249ae678f0dac4c625c6de6aca53823a

SHA1
6ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201

SHA256
7298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce

SHA512
66e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7

Download Submit
memory/816-144-0x0000000074050000-0x0000000074601000-memory.dmp

Filesize
5.7MB

Download
memory/816-146-0x0000000074050000-0x0000000074601000-memory.dmp

Filesize
5.7MB

Download
memory/816-147-0x0000000074050000-0x0000000074601000-memory.dmp

Filesize
5.7MB

Download
memory/3248-136-0x0000000074050000-0x0000000074601000-memory.dmp

Filesize
5.7MB

Download
memory/3248-145-0x0000000074050000-0x0000000074601000-memory.dmp

Filesize
5.7MB

Download
memory/3248-148-0x0000000074050000-0x0000000074601000-memory.dmp

Filesize
5.7MB

Download