Analysis
-
max time kernel
187s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 16:09
Static task
static1
Behavioral task
behavioral1
Sample
e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
-
Size
481KB
-
MD5
b9b314fc245634b5230eea2736c24959
-
SHA1
1ef8f02c5a60a70d88b79d263a1646b4c9ef9815
-
SHA256
e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62
-
SHA512
dd4fb8f45480b9591140e4e813add30bad1c8eab3ccadfd00e3d5e4c05e36170c4345e2af52b5b332bdb9145c594b867199899ace2f0712178f3e88e494172a8
-
SSDEEP
6144:JXjbNpPRMx8hU9K+SRhj+dBsWHuKCRnNrMmv1IH/V0MgraPWGuLfcwSpb1H78i+L:+NikBsKPVZwa+2J7p55UbEy
Score
10/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3124 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Local\\Default Folder\\system2.exe" e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Default Key = "\\Default Folder\\system2.exe" e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4616 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3124 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 3124 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3124 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 1940 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4976 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe Token: SeDebugPrivilege 3124 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe Token: SeDebugPrivilege 1940 Taskmgr.exe Token: SeSystemProfilePrivilege 1940 Taskmgr.exe Token: SeCreateGlobalPrivilege 1940 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe 1940 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3124 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4976 wrote to memory of 3124 4976 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 81 PID 4976 wrote to memory of 3124 4976 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 81 PID 4976 wrote to memory of 3124 4976 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 81 PID 4976 wrote to memory of 1460 4976 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 82 PID 4976 wrote to memory of 1460 4976 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 82 PID 4976 wrote to memory of 1460 4976 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 82 PID 3124 wrote to memory of 1940 3124 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 84 PID 3124 wrote to memory of 1940 3124 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 84 PID 3124 wrote to memory of 1940 3124 e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe 84 PID 1460 wrote to memory of 4616 1460 cmd.exe 85 PID 1460 wrote to memory of 4616 1460 cmd.exe 85 PID 1460 wrote to memory of 4616 1460 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe"C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe"C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1940
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:4616
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
Filesize481KB
MD5b9b314fc245634b5230eea2736c24959
SHA11ef8f02c5a60a70d88b79d263a1646b4c9ef9815
SHA256e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62
SHA512dd4fb8f45480b9591140e4e813add30bad1c8eab3ccadfd00e3d5e4c05e36170c4345e2af52b5b332bdb9145c594b867199899ace2f0712178f3e88e494172a8
-
C:\Users\Admin\AppData\Local\Temp\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62\e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62.exe
Filesize481KB
MD5b9b314fc245634b5230eea2736c24959
SHA11ef8f02c5a60a70d88b79d263a1646b4c9ef9815
SHA256e352336170b56831ba5768ec6af2ae592abc72398d98f0c1a9a53773e2878a62
SHA512dd4fb8f45480b9591140e4e813add30bad1c8eab3ccadfd00e3d5e4c05e36170c4345e2af52b5b332bdb9145c594b867199899ace2f0712178f3e88e494172a8