Analysis
-
max time kernel
263s -
max time network
316s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 01:10
Static task
static1
Behavioral task
behavioral1
Sample
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe
Resource
win10v2004-20221111-en
General
-
Target
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe
-
Size
189KB
-
MD5
eeb7e6c7f4ab9c7830b11f7fd7fd2011
-
SHA1
beb0384bd419447ab753de454e8d071923928e98
-
SHA256
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c
-
SHA512
ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208
-
SSDEEP
3072:w7F7r/UFftCzKka2Y2dMOSbSl8+pOW3jfSgDdB:88F2BdbjbbjzDf
Malware Config
Extracted
tofsee
91.121.4.118
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
pccxwbu.exepccxwbu.exepid process 3548 pccxwbu.exe 4688 pccxwbu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\pccxwbu.exe\" /r" c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exepccxwbu.exepccxwbu.exedescription pid process target process PID 4428 set thread context of 896 4428 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 3548 set thread context of 4688 3548 pccxwbu.exe pccxwbu.exe PID 4688 set thread context of 4640 4688 pccxwbu.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exec768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exepccxwbu.exepccxwbu.exedescription pid process target process PID 4428 wrote to memory of 896 4428 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 4428 wrote to memory of 896 4428 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 4428 wrote to memory of 896 4428 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 4428 wrote to memory of 896 4428 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 4428 wrote to memory of 896 4428 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 4428 wrote to memory of 896 4428 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 4428 wrote to memory of 896 4428 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 4428 wrote to memory of 896 4428 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 4428 wrote to memory of 896 4428 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 896 wrote to memory of 3548 896 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe pccxwbu.exe PID 896 wrote to memory of 3548 896 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe pccxwbu.exe PID 896 wrote to memory of 3548 896 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe pccxwbu.exe PID 3548 wrote to memory of 4688 3548 pccxwbu.exe pccxwbu.exe PID 3548 wrote to memory of 4688 3548 pccxwbu.exe pccxwbu.exe PID 3548 wrote to memory of 4688 3548 pccxwbu.exe pccxwbu.exe PID 3548 wrote to memory of 4688 3548 pccxwbu.exe pccxwbu.exe PID 3548 wrote to memory of 4688 3548 pccxwbu.exe pccxwbu.exe PID 3548 wrote to memory of 4688 3548 pccxwbu.exe pccxwbu.exe PID 3548 wrote to memory of 4688 3548 pccxwbu.exe pccxwbu.exe PID 3548 wrote to memory of 4688 3548 pccxwbu.exe pccxwbu.exe PID 3548 wrote to memory of 4688 3548 pccxwbu.exe pccxwbu.exe PID 4688 wrote to memory of 4640 4688 pccxwbu.exe svchost.exe PID 4688 wrote to memory of 4640 4688 pccxwbu.exe svchost.exe PID 4688 wrote to memory of 4640 4688 pccxwbu.exe svchost.exe PID 4688 wrote to memory of 4640 4688 pccxwbu.exe svchost.exe PID 4688 wrote to memory of 4640 4688 pccxwbu.exe svchost.exe PID 896 wrote to memory of 2364 896 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe cmd.exe PID 896 wrote to memory of 2364 896 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe cmd.exe PID 896 wrote to memory of 2364 896 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe"C:\Users\Admin\AppData\Local\Temp\c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe"C:\Users\Admin\AppData\Local\Temp\c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\pccxwbu.exe"C:\Users\Admin\pccxwbu.exe" /r3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\pccxwbu.exe"C:\Users\Admin\pccxwbu.exe" /r4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0865.bat" "3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4640 -ip 46401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0865.batFilesize
135B
MD5d68df8a31ba181db42b5dd40c8b3ce5c
SHA168e43aa995ea31afb318abbb545f84fc95dd8df4
SHA2564fd5f22567817411e13799be168e4335e057b5ea3446f49173631f60bf4a3663
SHA5125b562767fcd19608508077c30d1d37213a69a8c7fed8cae086d5ec1b755d7056d3fd7a3cb1497a214a366432804e3d74d30ac34b1da1ec2e784ebe5325fa692d
-
C:\Users\Admin\pccxwbu.exeFilesize
189KB
MD5eeb7e6c7f4ab9c7830b11f7fd7fd2011
SHA1beb0384bd419447ab753de454e8d071923928e98
SHA256c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c
SHA512ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208
-
C:\Users\Admin\pccxwbu.exeFilesize
189KB
MD5eeb7e6c7f4ab9c7830b11f7fd7fd2011
SHA1beb0384bd419447ab753de454e8d071923928e98
SHA256c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c
SHA512ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208
-
C:\Users\Admin\pccxwbu.exeFilesize
189KB
MD5eeb7e6c7f4ab9c7830b11f7fd7fd2011
SHA1beb0384bd419447ab753de454e8d071923928e98
SHA256c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c
SHA512ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208
-
memory/896-137-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/896-134-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/896-140-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/896-133-0x0000000000000000-mapping.dmp
-
memory/896-152-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2364-156-0x0000000000000000-mapping.dmp
-
memory/3548-138-0x0000000000000000-mapping.dmp
-
memory/3548-141-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3548-146-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4428-136-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4428-132-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4640-151-0x0000000000110000-0x0000000000136000-memory.dmpFilesize
152KB
-
memory/4640-150-0x0000000000000000-mapping.dmp
-
memory/4640-155-0x0000000000110000-0x0000000000136000-memory.dmpFilesize
152KB
-
memory/4688-149-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/4688-143-0x0000000000000000-mapping.dmp