b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c

Analysis

max time kernel
210s
max time network
251s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe
Size 452KB
Sample221202-yvebqsdf3y
SHA256 b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c
MD5 32a650cc2e4b751741cda53745effb07
SHA1 646a101f72e8a33c1ed8910eaeebd569985cb15d
SHA512 a43d95f6a472f03c68dbb26d269d70664f74f549b2a9c268476ae6e837b01de28d2e0856ccce776f62a2513febd39a5f0165c20369964656e5ff9949a7c33135
SSDEEP 6144:plRm973fQ6xfE9sNYGl73IBtWcp+G18MXExFVazIaZoE:pl41zfEOYGxSp+GKMXExFVWIaKE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2076	inlB1E7.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File created	C:\Windows\Installer\e5a3365.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a3365.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe
1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe
Token: SeShutdownPrivilege	4340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4340	msiexec.exe
Token: SeSecurityPrivilege	1440	msiexec.exe
Token: SeCreateTokenPrivilege	4340	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4340	msiexec.exe
Token: SeLockMemoryPrivilege	4340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4340	msiexec.exe
Token: SeMachineAccountPrivilege	4340	msiexec.exe
Token: SeTcbPrivilege	4340	msiexec.exe
Token: SeSecurityPrivilege	4340	msiexec.exe
Token: SeTakeOwnershipPrivilege	4340	msiexec.exe
Token: SeLoadDriverPrivilege	4340	msiexec.exe
Token: SeSystemProfilePrivilege	4340	msiexec.exe
Token: SeSystemtimePrivilege	4340	msiexec.exe
Token: SeProfSingleProcessPrivilege	4340	msiexec.exe
Token: SeIncBasePriorityPrivilege	4340	msiexec.exe
Token: SeCreatePagefilePrivilege	4340	msiexec.exe
Token: SeCreatePermanentPrivilege	4340	msiexec.exe
Token: SeBackupPrivilege	4340	msiexec.exe
Token: SeRestorePrivilege	4340	msiexec.exe
Token: SeShutdownPrivilege	4340	msiexec.exe
Token: SeDebugPrivilege	4340	msiexec.exe
Token: SeAuditPrivilege	4340	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4340	msiexec.exe
Token: SeChangeNotifyPrivilege	4340	msiexec.exe
Token: SeRemoteShutdownPrivilege	4340	msiexec.exe
Token: SeUndockPrivilege	4340	msiexec.exe
Token: SeSyncAgentPrivilege	4340	msiexec.exe
Token: SeEnableDelegationPrivilege	4340	msiexec.exe
Token: SeManageVolumePrivilege	4340	msiexec.exe
Token: SeImpersonatePrivilege	4340	msiexec.exe
Token: SeCreateGlobalPrivilege	4340	msiexec.exe
Token: SeRestorePrivilege	1440	msiexec.exe
Token: SeTakeOwnershipPrivilege	1440	msiexec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1108	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	86
PID 1512 wrote to memory of 1108	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	86
PID 1512 wrote to memory of 1108	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	86
PID 1512 wrote to memory of 4340	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	89
PID 1512 wrote to memory of 4340	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	89
PID 1512 wrote to memory of 4340	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	89
PID 1512 wrote to memory of 5032	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	90
PID 1512 wrote to memory of 5032	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	90
PID 1512 wrote to memory of 5032	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	90
PID 1512 wrote to memory of 4448	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	92
PID 1512 wrote to memory of 4448	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	92
PID 1512 wrote to memory of 4448	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	92
PID 1512 wrote to memory of 4780	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	94
PID 1512 wrote to memory of 4780	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	94
PID 1512 wrote to memory of 4780	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	94
PID 4448 wrote to memory of 1728	4448	cmd.exe	95
PID 4448 wrote to memory of 1728	4448	cmd.exe	95
PID 4448 wrote to memory of 1728	4448	cmd.exe	95
PID 5032 wrote to memory of 2076	5032	cmd.exe	96
PID 5032 wrote to memory of 2076	5032	cmd.exe	96
PID 5032 wrote to memory of 2076	5032	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe
"C:\Users\Admin\AppData\Local\Temp\b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat" "
  2⤵
  PID:1108
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\insEA1.tmp.msi" /quiet
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\inlB1E7.tmp
    C:\Users\Admin\AppData\Local\Temp\inlB1E7.tmp cdf1912.tmp
    3⤵
    - Executes dropped EXE
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\expand.exe
    expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"
    3⤵
    - Drops file in Windows directory
    PID:1728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B35A1C~1.EXE > nul
  2⤵
  PID:4780

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cdf1912.tmp

Path C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp
Size 768B
SHA256 d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8
MD5 d20d9eda31a2d0300e4589df7f352370
SHA1 79b46d2dbb489914cfedafdbc90e62951471b48e
SHA512 d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e
MD5 SHA1 SHA512

Submit Download

inlB1E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\inlB1E7.tmp
Size 57.2MB
SHA256 dcc16382334883cea49c7a2d292c7c41335600e9ec81bb02684b6fa951c08aea
MD5 af514d897277e6fca806018869d5631b
SHA1 2fdf1dc1b48c2c58c09943326e98f492a6312262
SHA512 1e8fdeeef4348f6a725813cb1a1e4429aea116d8512c889221d25fc4a2289c887f5c2ccc59347dd9945248f40d7f372a4958e55030632947d6a6d3f30aef92a6
SSDEEP 1572864:3VKwDVKwDVKwDVKwDVKwDVKwDVKwDVKwDVKwDVKwy:0777777777j
MD5 SHA1 SHA512 SSDEEP

Submit Download

inlB1E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\inlB1E7.tmp
Size 57.2MB
SHA256 dcc16382334883cea49c7a2d292c7c41335600e9ec81bb02684b6fa951c08aea
MD5 af514d897277e6fca806018869d5631b
SHA1 2fdf1dc1b48c2c58c09943326e98f492a6312262
SHA512 1e8fdeeef4348f6a725813cb1a1e4429aea116d8512c889221d25fc4a2289c887f5c2ccc59347dd9945248f40d7f372a4958e55030632947d6a6d3f30aef92a6
SSDEEP 1572864:3VKwDVKwDVKwDVKwDVKwDVKwDVKwDVKwDVKwDVKwy:0777777777j
MD5 SHA1 SHA512 SSDEEP

Submit Download

insEA1.tmp.msi

Path C:\Users\Admin\AppData\Local\Temp\insEA1.tmp.msi
Size 57.5MB
SHA256 c2105006c77f24d340f1cd949746376113011ec0491c1868fe5b63f8449f93ec
MD5 487e797e8262872b227fc9d9cdc89344
SHA1 bd1e5e9801bf418733cf744617ae5984ca5127fe
SHA512 36e2c05e6b24a1386735b5b85479127f16c564b8d1263716e4a9e844ccfd1968c71328c59fca862539ae43da50b0f54503a0e07d7047ee70b5202fdf91dbc207
SSDEEP 1572864:0VKwgVKwgVKwgVKwgVKwgVKwgVKwgVKwgVKwgVKwy:hyyyyyyyyyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

run_dws_file.bat

Path C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat
Size 57B
SHA256 185bbd2fbc74a1a321740bcfa187906b2df35042d5e7deaf81cac46a226aabc5
MD5 ede583285980f7c6cd9f78d5f4f1ee23
SHA1 3a838465fcf70888c9665f2739271ce4c9a1a186
SHA512 e6251714c6041c69e220f377fe5b57f1bad82076bf971b7d73e77dc7f682ed8b31feff0c8b83d14abc04044b8f76650a9f1a363cacbb26e54206a141bd5ddf56
MD5 SHA1 SHA512

Submit Download

run_kl_file.bat

Path C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat
Size 26B
SHA256 0fe404e349177b204405181c00c357c1ac82cbd04ca450e2faebeead2ef54b6d
MD5 49cb42ed4e90c1df7d7bd69348b4cac9
SHA1 0e06e4b6201177a24c304b02fb052d6f5393f314
SHA512 e42e038acbbf58c17a2fd0353b14f65d360ec886aafdade4e1d71ca45f9852d01a080a9d09676008aa15296a4ac87eb1ff6e29523d057f1d4452e21776cbc319
MD5 SHA1 SHA512

Submit Download

tmp_ext_favurl_cab.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat
Size 98B
SHA256 2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
MD5 8663de6fce9208b795dc913d1a6a3f5b
SHA1 882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA512 9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688
MD5 SHA1 SHA512

Submit Download

favorites_url.cab

Path \??\c:\users\admin\appdata\local\temp\favorites_url.cab
Size 425B
SHA256 73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
MD5 da68bc3b7c3525670a04366bc55629f5
SHA1 15fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA512 6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0
MD5 SHA1 SHA512

Submit Download

memory/1512-132-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1512-146-0x0000000000400000-0x000000000046E000-memory.dmp

Download