Analysis
-
max time kernel
153s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 18:38
Static task
static1
Behavioral task
behavioral1
Sample
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe
Resource
win10v2004-20221111-en
General
-
Target
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe
-
Size
43KB
-
MD5
3ff1d4d90089b7b85a311d36dd65df90
-
SHA1
ac9c6c488afb359abc4035ea448c3daed0e09247
-
SHA256
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9
-
SHA512
bda7bff84fa0c43c437dd1c9d677194672a00e33e5d171b77b520765d624773f03d772612dffef6b27f9f9b4dd12b1729e2a0e783455b2f531d3036ad10ae383
-
SSDEEP
768:OoJZf8+T6hhSEs2bArq92T62oz5c1+6HPjH/Qqvtu1C+V2r1afAGclevNU3QUvmF:RG27dPTPKhyafABlevtHCCrk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Windows.exepid process 3388 Windows.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe -
Drops startup file 2 IoCs
Processes:
Windows.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\55b3825ee39ada2fcddf7c7accbde69e.exe Windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\55b3825ee39ada2fcddf7c7accbde69e.exe Windows.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Windows.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\55b3825ee39ada2fcddf7c7accbde69e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." Windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\55b3825ee39ada2fcddf7c7accbde69e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." Windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
Windows.exepid process 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe 3388 Windows.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Windows.exedescription pid process Token: SeDebugPrivilege 3388 Windows.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exeWindows.exedescription pid process target process PID 2116 wrote to memory of 3388 2116 767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe Windows.exe PID 2116 wrote to memory of 3388 2116 767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe Windows.exe PID 2116 wrote to memory of 3388 2116 767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe Windows.exe PID 3388 wrote to memory of 4160 3388 Windows.exe netsh.exe PID 3388 wrote to memory of 4160 3388 Windows.exe netsh.exe PID 3388 wrote to memory of 4160 3388 Windows.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe"C:\Users\Admin\AppData\Local\Temp\767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Windows.exe"C:\Users\Admin\AppData\Local\Temp\Windows.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Windows.exe" "Windows.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Windows.exeFilesize
43KB
MD53ff1d4d90089b7b85a311d36dd65df90
SHA1ac9c6c488afb359abc4035ea448c3daed0e09247
SHA256767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9
SHA512bda7bff84fa0c43c437dd1c9d677194672a00e33e5d171b77b520765d624773f03d772612dffef6b27f9f9b4dd12b1729e2a0e783455b2f531d3036ad10ae383
-
C:\Users\Admin\AppData\Local\Temp\Windows.exeFilesize
43KB
MD53ff1d4d90089b7b85a311d36dd65df90
SHA1ac9c6c488afb359abc4035ea448c3daed0e09247
SHA256767fc0fe90030ec5cc5466605da13e262c889ffcfca8d189e0255096945060b9
SHA512bda7bff84fa0c43c437dd1c9d677194672a00e33e5d171b77b520765d624773f03d772612dffef6b27f9f9b4dd12b1729e2a0e783455b2f531d3036ad10ae383
-
memory/2116-132-0x0000000074D50000-0x0000000075301000-memory.dmpFilesize
5.7MB
-
memory/2116-137-0x0000000074D50000-0x0000000075301000-memory.dmpFilesize
5.7MB
-
memory/3388-133-0x0000000000000000-mapping.dmp
-
memory/3388-138-0x0000000074D50000-0x0000000075301000-memory.dmpFilesize
5.7MB
-
memory/3388-139-0x0000000074D50000-0x0000000075301000-memory.dmpFilesize
5.7MB
-
memory/4160-136-0x0000000000000000-mapping.dmp