Analysis
-
max time kernel
183s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 13:49
Static task
static1
Behavioral task
behavioral1
Sample
8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe
Resource
win7-20221111-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe
-
Size
507KB
-
MD5
8b6b7954f840329e2b0f67fb851ea9a6
-
SHA1
f62ec7c3ea1ef8d185b5f083813315e0b09a5f5f
-
SHA256
8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba
-
SHA512
01036290f9cc7d637c8d1d3cca9c2201ef273596bd5bb64d7089c88f5ce68086bba955fcb4624346102bc91651eb9331824176c0bbc8c84d12fae2d33eaf9be8
-
SSDEEP
6144:g4xJwZlYV28hU9K+SRhj+dBsWHuKCRnNrMmv1IH/V0MgraPWGuLfcwSpb1H78i+w:GNikBsKPVZwa+2J7p55Uh+1
Score
10/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1012 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Default Key = "\\Default Folder\\system2.exe" 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Local\\Default Folder\\system2.exe" 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3068 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1012 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 1012 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1012 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 3276 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4356 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe Token: SeDebugPrivilege 1012 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe Token: SeDebugPrivilege 3276 Taskmgr.exe Token: SeSystemProfilePrivilege 3276 Taskmgr.exe Token: SeCreateGlobalPrivilege 3276 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe 3276 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1012 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4356 wrote to memory of 1012 4356 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 82 PID 4356 wrote to memory of 1012 4356 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 82 PID 4356 wrote to memory of 1012 4356 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 82 PID 4356 wrote to memory of 2516 4356 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 83 PID 4356 wrote to memory of 2516 4356 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 83 PID 4356 wrote to memory of 2516 4356 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 83 PID 2516 wrote to memory of 3068 2516 cmd.exe 86 PID 2516 wrote to memory of 3068 2516 cmd.exe 86 PID 2516 wrote to memory of 3068 2516 cmd.exe 86 PID 1012 wrote to memory of 3276 1012 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 85 PID 1012 wrote to memory of 3276 1012 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 85 PID 1012 wrote to memory of 3276 1012 8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe"C:\Users\Admin\AppData\Local\Temp\8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba\8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe"C:\Users\Admin\AppData\Local\Temp\8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba\8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3276
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:3068
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba\8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe
Filesize507KB
MD58b6b7954f840329e2b0f67fb851ea9a6
SHA1f62ec7c3ea1ef8d185b5f083813315e0b09a5f5f
SHA2568c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba
SHA51201036290f9cc7d637c8d1d3cca9c2201ef273596bd5bb64d7089c88f5ce68086bba955fcb4624346102bc91651eb9331824176c0bbc8c84d12fae2d33eaf9be8
-
C:\Users\Admin\AppData\Local\Temp\8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba\8c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba.exe
Filesize507KB
MD58b6b7954f840329e2b0f67fb851ea9a6
SHA1f62ec7c3ea1ef8d185b5f083813315e0b09a5f5f
SHA2568c99f6f03fc27560d25597b365b3d8e64560f6156c840151131d71cf5e0a1fba
SHA51201036290f9cc7d637c8d1d3cca9c2201ef273596bd5bb64d7089c88f5ce68086bba955fcb4624346102bc91651eb9331824176c0bbc8c84d12fae2d33eaf9be8