Overview

overview

8

Static

static

8

199903a15e...0e.exe

windows7-x64

8

199903a15e...0e.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 03:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    199903a15e0d8cf4b14dd0a1a0c14c473a43e7d9f939e639c0cf898d1f3b0b0e.exe

  • Size

    224KB

  • MD5

    3d87ad286ea6ba21c992de2aeefef580

  • SHA1

    6eb4f26558fe718c577f15af7c07aa2b28a162f2

  • SHA256

    199903a15e0d8cf4b14dd0a1a0c14c473a43e7d9f939e639c0cf898d1f3b0b0e

  • SHA512

    c25f0cd781280ca839932fef073facb83719fa4861ae771efbf385ee9a78bc3ca02a26378818a6b40fe5e0cf5d597cd5ddcdab799e02573f5739daa19f01c237

  • SSDEEP

    6144:af36DoS5uFULGySd6Rp+PQtWvWFmF4GyfNKwBAA:aaoSkXuWvAmFHyfXBF

Score
8/10
persistenceupx

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\199903a15e0d8cf4b14dd0a1a0c14c473a43e7d9f939e639c0cf898d1f3b0b0e.exe
    "C:\Users\Admin\AppData\Local\Temp\199903a15e0d8cf4b14dd0a1a0c14c473a43e7d9f939e639c0cf898d1f3b0b0e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1316
    • \??\c:\users\admin\appdata\local\temp\199903a15e0d8cf4b14dd0a1a0c14c473a43e7d9f939e639c0cf898d1f3b0b0e.exe
      "c:\users\admin\appdata\local\temp\199903a15e0d8cf4b14dd0a1a0c14c473a43e7d9f939e639c0cf898d1f3b0b0e.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5072
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\appdata\local\temp\240566296.bat" "c:\users\admin\appdata\local\temp\199903a15e0d8cf4b14dd0a1a0c14c473a43e7d9f939e639c0cf898d1f3b0b0e.exe""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:848
        • C:\Windows\SysWOW64\attrib.exe
          attrib -r -s -h "c:\users\admin\appdata\local\temp\199903a15e0d8cf4b14dd0a1a0c14c473a43e7d9f939e639c0cf898d1f3b0b0e.exe"
          4⤵
          • Views/modifies file attributes
          PID:720
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3116
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2296

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\appdata\local\temp\240566296.bat
          Filesize

          76B

          MD5

          7fbf40bdd5c6f46b36ce740da6336359

          SHA1

          2386cd44d79f9244e43c78a64ec0d12ea6c7f7b5

          SHA256

          b3b7798750bbe931d15f615800d975e021b11a42e6812afbdfb735ec1e952376

          SHA512

          153c76ced8bfa2ca518a71c8c7394954dbee3c88b944bfbec3484d6abe78b15f3732a494a260ff80408374f382ddb8c932fd839d4af96dc91f416997a7ca97dc

          Download Submit

        • memory/1316-136-0x0000000000400000-0x000000000040D000-memory.dmp

          Filesize

          52KB

          Download

        • memory/2296-169-0x0000022324DC8000-0x0000022324DD0000-memory.dmp

          Filesize

          32KB

          Download

        • memory/2296-172-0x0000022324C00000-0x0000022324C20000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2296-195-0x000002232703A000-0x000002232703D000-memory.dmp

          Filesize

          12KB

          Download

        • memory/2296-194-0x000002232703A000-0x000002232703D000-memory.dmp

          Filesize

          12KB

          Download

        • memory/2296-193-0x000002232703A000-0x000002232703D000-memory.dmp

          Filesize

          12KB

          Download

        • memory/2296-190-0x0000022327001000-0x0000022327005000-memory.dmp

          Filesize

          16KB

          Download

        • memory/2296-189-0x0000022327001000-0x0000022327005000-memory.dmp

          Filesize

          16KB

          Download

        • memory/2296-157-0x000002232700C000-0x000002232700F000-memory.dmp

          Filesize

          12KB

          Download

        • memory/2296-156-0x000002232700C000-0x000002232700F000-memory.dmp

          Filesize

          12KB

          Download

        • memory/2296-159-0x000002232700C000-0x000002232700F000-memory.dmp

          Filesize

          12KB

          Download

        • memory/2296-158-0x000002232700C000-0x000002232700F000-memory.dmp

          Filesize

          12KB

          Download

        • memory/2296-164-0x0000022327010000-0x0000022327014000-memory.dmp

          Filesize

          16KB

          Download

        • memory/2296-163-0x0000022327010000-0x0000022327014000-memory.dmp

          Filesize

          16KB

          Download

        • memory/2296-165-0x0000022327010000-0x0000022327014000-memory.dmp

          Filesize

          16KB

          Download

        • memory/2296-162-0x0000022327010000-0x0000022327014000-memory.dmp

          Filesize

          16KB

          Download

        • memory/2296-161-0x0000022327010000-0x0000022327014000-memory.dmp

          Filesize

          16KB

          Download

        • memory/2296-167-0x0000022339DC0000-0x0000022339EC0000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2296-168-0x0000022323D00000-0x0000022323E00000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2296-188-0x0000022327001000-0x0000022327005000-memory.dmp

          Filesize

          16KB

          Download

        • memory/2296-170-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-187-0x0000022327001000-0x0000022327005000-memory.dmp

          Filesize

          16KB

          Download

        • memory/2296-173-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-171-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-175-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-174-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-176-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-178-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-177-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-179-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-180-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-181-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-182-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-183-0x000002232702C000-0x0000022327038000-memory.dmp

          Filesize

          48KB

          Download

        • memory/2296-185-0x0000022324E80000-0x0000022324EA0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4760-139-0x0000000001000000-0x0000000001037000-memory.dmp

          Filesize

          220KB

          Download

        • memory/4760-134-0x0000000001000000-0x0000000001037000-memory.dmp

          Filesize

          220KB

          Download

        • memory/4760-137-0x0000000001000000-0x0000000001037000-memory.dmp

          Filesize

          220KB

          Download

        • memory/4760-142-0x0000000001000000-0x0000000001037000-memory.dmp

          Filesize

          220KB

          Download

        • memory/4760-140-0x0000000000400000-0x000000000040D000-memory.dmp

          Filesize

          52KB

          Download