c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6

Analysis

max time kernel
182s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6.exe
Size

330KB
MD5

bdc84c56b896e038fe3694ced662052b
SHA1

aadcf7b190b059096955214946a310278994e065
SHA256

c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6
SHA512

fc766546ec84799652649a10edf0a7d9e376126d1ef3624f137546705f8fcda2a0a6539b2439a76f557831a6dfb912ce3cfa3d110ccaec1d77ee17bfef0f587b
SSDEEP

6144:Lkrda5bQfH21gknQVwKymXL+/KBnkmPR1npnB4rXJOpK3/mH8zLBYmWr7zeyL4K:L2StYiQ4K

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2972	service.exe
4856	service.exe
2540	service.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4560-132-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/files/0x000300000000072b-139.dat	upx
behavioral2/memory/4560-140-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/files/0x000300000000072b-141.dat	upx
behavioral2/memory/2972-144-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/files/0x000300000000072b-147.dat	upx
behavioral2/memory/2972-149-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/files/0x000300000000072b-154.dat	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\service.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 4856	2972	service.exe	86
PID 4856 set thread context of 2540	4856	service.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4560	c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6.exe
2972	service.exe
4856	service.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 5060	4560	c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6.exe	81
PID 4560 wrote to memory of 5060	4560	c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6.exe	81
PID 4560 wrote to memory of 5060	4560	c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6.exe	81
PID 5060 wrote to memory of 884	5060	cmd.exe	84
PID 5060 wrote to memory of 884	5060	cmd.exe	84
PID 5060 wrote to memory of 884	5060	cmd.exe	84
PID 4560 wrote to memory of 2972	4560	c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6.exe	85
PID 4560 wrote to memory of 2972	4560	c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6.exe	85
PID 4560 wrote to memory of 2972	4560	c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6.exe	85
PID 2972 wrote to memory of 4856	2972	service.exe	86
PID 2972 wrote to memory of 4856	2972	service.exe	86
PID 2972 wrote to memory of 4856	2972	service.exe	86
PID 2972 wrote to memory of 4856	2972	service.exe	86
PID 2972 wrote to memory of 4856	2972	service.exe	86
PID 2972 wrote to memory of 4856	2972	service.exe	86
PID 2972 wrote to memory of 4856	2972	service.exe	86
PID 2972 wrote to memory of 4856	2972	service.exe	86
PID 4856 wrote to memory of 2540	4856	service.exe	87
PID 4856 wrote to memory of 2540	4856	service.exe	87
PID 4856 wrote to memory of 2540	4856	service.exe	87
PID 4856 wrote to memory of 2540	4856	service.exe	87
PID 4856 wrote to memory of 2540	4856	service.exe	87
PID 4856 wrote to memory of 2540	4856	service.exe	87
PID 4856 wrote to memory of 2540	4856	service.exe	87
PID 4856 wrote to memory of 2540	4856	service.exe	87
PID 4856 wrote to memory of 2540	4856	service.exe	87
PID 4856 wrote to memory of 2540	4856	service.exe	87

C:\Users\Admin\AppData\Local\Temp\c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6.exe
"C:\Users\Admin\AppData\Local\Temp\c28603e3fe6b1e27c2f929c4863ee4c31439b6103536b9f43709ce3015203ba6.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240585937.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\service.exe" /f
    3⤵
    - Adds Run key to start application
    PID:884
- C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\service.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
      4⤵
      Executes dropped EXE
      PID:2540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240585937.bat

Filesize
146B

MD5
7eee65b102f30fd1ead48a8cd3b99827

SHA1
2f74a754019f280c6186c11531d460006814952e

SHA256
5748c60056db288b67e61148b339778816279e36907977f4fe03b5df04f6b57f

SHA512
a06de9e35ada579a95b2ba399e4c65b074d642788d456e10e0ae967896ac729c552f715261d9dc8c17fffca8d6b9144a6155ff11ab8569a82bdbd9d26109bd85

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\service.exe

Filesize
330KB

MD5
9e4efe0a8fa703e04bfcd648adb6ba4c

SHA1
7fec71731c876f23de45ce9e3ba66caa9e16f505

SHA256
ce5aa1cf2043a77cdcc58d7b6d14ab05e3022d7b7e68b35b714bd33a9c4db869

SHA512
b1bf9e5bfe35f9da319af741cac23b1e9fe4bdc662ded3ae7d350aa224421408f28e315f36771895d3be77567ed6709bec9bbd777064c2a8e9e31ac6413bb778

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\service.exe

Filesize
330KB

MD5
9e4efe0a8fa703e04bfcd648adb6ba4c

SHA1
7fec71731c876f23de45ce9e3ba66caa9e16f505

SHA256
ce5aa1cf2043a77cdcc58d7b6d14ab05e3022d7b7e68b35b714bd33a9c4db869

SHA512
b1bf9e5bfe35f9da319af741cac23b1e9fe4bdc662ded3ae7d350aa224421408f28e315f36771895d3be77567ed6709bec9bbd777064c2a8e9e31ac6413bb778

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\service.exe

Filesize
330KB

MD5
9e4efe0a8fa703e04bfcd648adb6ba4c

SHA1
7fec71731c876f23de45ce9e3ba66caa9e16f505

SHA256
ce5aa1cf2043a77cdcc58d7b6d14ab05e3022d7b7e68b35b714bd33a9c4db869

SHA512
b1bf9e5bfe35f9da319af741cac23b1e9fe4bdc662ded3ae7d350aa224421408f28e315f36771895d3be77567ed6709bec9bbd777064c2a8e9e31ac6413bb778

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\service.exe

Filesize
330KB

MD5
9e4efe0a8fa703e04bfcd648adb6ba4c

SHA1
7fec71731c876f23de45ce9e3ba66caa9e16f505

SHA256
ce5aa1cf2043a77cdcc58d7b6d14ab05e3022d7b7e68b35b714bd33a9c4db869

SHA512
b1bf9e5bfe35f9da319af741cac23b1e9fe4bdc662ded3ae7d350aa224421408f28e315f36771895d3be77567ed6709bec9bbd777064c2a8e9e31ac6413bb778

Download Submit
memory/2540-158-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2540-156-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2540-153-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2972-144-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2972-149-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4560-132-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4560-140-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4856-146-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4856-157-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download