b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c

Analysis

max time kernel
210s
max time network
251s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe
Size

452KB
MD5

32a650cc2e4b751741cda53745effb07
SHA1

646a101f72e8a33c1ed8910eaeebd569985cb15d
SHA256

b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c
SHA512

a43d95f6a472f03c68dbb26d269d70664f74f549b2a9c268476ae6e837b01de28d2e0856ccce776f62a2513febd39a5f0165c20369964656e5ff9949a7c33135
SSDEEP

6144:plRm973fQ6xfE9sNYGl73IBtWcp+G18MXExFVazIaZoE:pl41zfEOYGxSp+GKMXExFVWIaKE

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2076	inlB1E7.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File created	C:\Windows\Installer\e5a3365.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a3365.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe
1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe
Token: SeShutdownPrivilege	4340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4340	msiexec.exe
Token: SeSecurityPrivilege	1440	msiexec.exe
Token: SeCreateTokenPrivilege	4340	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4340	msiexec.exe
Token: SeLockMemoryPrivilege	4340	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4340	msiexec.exe
Token: SeMachineAccountPrivilege	4340	msiexec.exe
Token: SeTcbPrivilege	4340	msiexec.exe
Token: SeSecurityPrivilege	4340	msiexec.exe
Token: SeTakeOwnershipPrivilege	4340	msiexec.exe
Token: SeLoadDriverPrivilege	4340	msiexec.exe
Token: SeSystemProfilePrivilege	4340	msiexec.exe
Token: SeSystemtimePrivilege	4340	msiexec.exe
Token: SeProfSingleProcessPrivilege	4340	msiexec.exe
Token: SeIncBasePriorityPrivilege	4340	msiexec.exe
Token: SeCreatePagefilePrivilege	4340	msiexec.exe
Token: SeCreatePermanentPrivilege	4340	msiexec.exe
Token: SeBackupPrivilege	4340	msiexec.exe
Token: SeRestorePrivilege	4340	msiexec.exe
Token: SeShutdownPrivilege	4340	msiexec.exe
Token: SeDebugPrivilege	4340	msiexec.exe
Token: SeAuditPrivilege	4340	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4340	msiexec.exe
Token: SeChangeNotifyPrivilege	4340	msiexec.exe
Token: SeRemoteShutdownPrivilege	4340	msiexec.exe
Token: SeUndockPrivilege	4340	msiexec.exe
Token: SeSyncAgentPrivilege	4340	msiexec.exe
Token: SeEnableDelegationPrivilege	4340	msiexec.exe
Token: SeManageVolumePrivilege	4340	msiexec.exe
Token: SeImpersonatePrivilege	4340	msiexec.exe
Token: SeCreateGlobalPrivilege	4340	msiexec.exe
Token: SeRestorePrivilege	1440	msiexec.exe
Token: SeTakeOwnershipPrivilege	1440	msiexec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1108	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	86
PID 1512 wrote to memory of 1108	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	86
PID 1512 wrote to memory of 1108	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	86
PID 1512 wrote to memory of 4340	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	89
PID 1512 wrote to memory of 4340	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	89
PID 1512 wrote to memory of 4340	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	89
PID 1512 wrote to memory of 5032	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	90
PID 1512 wrote to memory of 5032	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	90
PID 1512 wrote to memory of 5032	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	90
PID 1512 wrote to memory of 4448	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	92
PID 1512 wrote to memory of 4448	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	92
PID 1512 wrote to memory of 4448	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	92
PID 1512 wrote to memory of 4780	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	94
PID 1512 wrote to memory of 4780	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	94
PID 1512 wrote to memory of 4780	1512	b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe	94
PID 4448 wrote to memory of 1728	4448	cmd.exe	95
PID 4448 wrote to memory of 1728	4448	cmd.exe	95
PID 4448 wrote to memory of 1728	4448	cmd.exe	95
PID 5032 wrote to memory of 2076	5032	cmd.exe	96
PID 5032 wrote to memory of 2076	5032	cmd.exe	96
PID 5032 wrote to memory of 2076	5032	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe
"C:\Users\Admin\AppData\Local\Temp\b35a1c26a044ca798226c140f2e72e7a933abb7af682148212364ea55729b38c.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat" "
  2⤵
  PID:1108
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\insEA1.tmp.msi" /quiet
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\inlB1E7.tmp
    C:\Users\Admin\AppData\Local\Temp\inlB1E7.tmp cdf1912.tmp
    3⤵
    - Executes dropped EXE
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\expand.exe
    expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"
    3⤵
    - Drops file in Windows directory
    PID:1728
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B35A1C~1.EXE > nul
  2⤵
  PID:4780

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
768B

MD5
d20d9eda31a2d0300e4589df7f352370

SHA1
79b46d2dbb489914cfedafdbc90e62951471b48e

SHA256
d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8

SHA512
d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlB1E7.tmp

Filesize
57.2MB

MD5
af514d897277e6fca806018869d5631b

SHA1
2fdf1dc1b48c2c58c09943326e98f492a6312262

SHA256
dcc16382334883cea49c7a2d292c7c41335600e9ec81bb02684b6fa951c08aea

SHA512
1e8fdeeef4348f6a725813cb1a1e4429aea116d8512c889221d25fc4a2289c887f5c2ccc59347dd9945248f40d7f372a4958e55030632947d6a6d3f30aef92a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlB1E7.tmp

Filesize
57.2MB

MD5
af514d897277e6fca806018869d5631b

SHA1
2fdf1dc1b48c2c58c09943326e98f492a6312262

SHA256
dcc16382334883cea49c7a2d292c7c41335600e9ec81bb02684b6fa951c08aea

SHA512
1e8fdeeef4348f6a725813cb1a1e4429aea116d8512c889221d25fc4a2289c887f5c2ccc59347dd9945248f40d7f372a4958e55030632947d6a6d3f30aef92a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\insEA1.tmp.msi

Filesize
57.5MB

MD5
487e797e8262872b227fc9d9cdc89344

SHA1
bd1e5e9801bf418733cf744617ae5984ca5127fe

SHA256
c2105006c77f24d340f1cd949746376113011ec0491c1868fe5b63f8449f93ec

SHA512
36e2c05e6b24a1386735b5b85479127f16c564b8d1263716e4a9e844ccfd1968c71328c59fca862539ae43da50b0f54503a0e07d7047ee70b5202fdf91dbc207

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

Filesize
57B

MD5
ede583285980f7c6cd9f78d5f4f1ee23

SHA1
3a838465fcf70888c9665f2739271ce4c9a1a186

SHA256
185bbd2fbc74a1a321740bcfa187906b2df35042d5e7deaf81cac46a226aabc5

SHA512
e6251714c6041c69e220f377fe5b57f1bad82076bf971b7d73e77dc7f682ed8b31feff0c8b83d14abc04044b8f76650a9f1a363cacbb26e54206a141bd5ddf56

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat

Filesize
26B

MD5
49cb42ed4e90c1df7d7bd69348b4cac9

SHA1
0e06e4b6201177a24c304b02fb052d6f5393f314

SHA256
0fe404e349177b204405181c00c357c1ac82cbd04ca450e2faebeead2ef54b6d

SHA512
e42e038acbbf58c17a2fd0353b14f65d360ec886aafdade4e1d71ca45f9852d01a080a9d09676008aa15296a4ac87eb1ff6e29523d057f1d4452e21776cbc319

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

Filesize
98B

MD5
8663de6fce9208b795dc913d1a6a3f5b

SHA1
882193f208cf012eaf22eeaa4fef3b67e7c67c15

SHA256
2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61

SHA512
9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

Download Submit
\??\c:\users\admin\appdata\local\temp\favorites_url.cab

Filesize
425B

MD5
da68bc3b7c3525670a04366bc55629f5

SHA1
15fda47ecfead7db8f7aee6ca7570138ba7f1b71

SHA256
73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5

SHA512
6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

Download Submit
memory/1512-132-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1512-146-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download