Analysis
-
max time kernel
112s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe
-
Size
150KB
-
MD5
31b593dbc0d5377f505caa2997257077
-
SHA1
e8c8824d6227bc02ef82cbca35ad68ed3a903b40
-
SHA256
9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e
-
SHA512
f7194ea6f8f7864c8f9d1444c777555f33408a7b62e877f6bd4093a129a7b00833ac065481562e785ae3db25f729982900ac881e5f2f46f2e773b120a25ab2ea
-
SSDEEP
3072:i/bB148ipXFuYaMuHlbvHBjN5ovkXU6qHbxhHwCK:iONHJ4lbYkXNobxhQx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3928 inlC039.tmp -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation inlC039.tmp -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e56c568.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID2F5.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{F3BC1915-ACD8-4A96-806F-9C0C6617C282} msiexec.exe File created C:\Windows\Installer\e56c56b.msi msiexec.exe File created C:\Windows\Installer\e56c568.msi msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log expand.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log expand.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 4872 msiexec.exe 4872 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3144 msiexec.exe Token: SeIncreaseQuotaPrivilege 3144 msiexec.exe Token: SeSecurityPrivilege 4872 msiexec.exe Token: SeIncBasePriorityPrivilege 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe Token: SeCreateTokenPrivilege 3144 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3144 msiexec.exe Token: SeLockMemoryPrivilege 3144 msiexec.exe Token: SeIncreaseQuotaPrivilege 3144 msiexec.exe Token: SeMachineAccountPrivilege 3144 msiexec.exe Token: SeTcbPrivilege 3144 msiexec.exe Token: SeSecurityPrivilege 3144 msiexec.exe Token: SeTakeOwnershipPrivilege 3144 msiexec.exe Token: SeLoadDriverPrivilege 3144 msiexec.exe Token: SeSystemProfilePrivilege 3144 msiexec.exe Token: SeSystemtimePrivilege 3144 msiexec.exe Token: SeProfSingleProcessPrivilege 3144 msiexec.exe Token: SeIncBasePriorityPrivilege 3144 msiexec.exe Token: SeCreatePagefilePrivilege 3144 msiexec.exe Token: SeCreatePermanentPrivilege 3144 msiexec.exe Token: SeBackupPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 3144 msiexec.exe Token: SeShutdownPrivilege 3144 msiexec.exe Token: SeDebugPrivilege 3144 msiexec.exe Token: SeAuditPrivilege 3144 msiexec.exe Token: SeSystemEnvironmentPrivilege 3144 msiexec.exe Token: SeChangeNotifyPrivilege 3144 msiexec.exe Token: SeRemoteShutdownPrivilege 3144 msiexec.exe Token: SeUndockPrivilege 3144 msiexec.exe Token: SeSyncAgentPrivilege 3144 msiexec.exe Token: SeEnableDelegationPrivilege 3144 msiexec.exe Token: SeManageVolumePrivilege 3144 msiexec.exe Token: SeImpersonatePrivilege 3144 msiexec.exe Token: SeCreateGlobalPrivilege 3144 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4844 wrote to memory of 1440 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 81 PID 4844 wrote to memory of 1440 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 81 PID 4844 wrote to memory of 1440 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 81 PID 4844 wrote to memory of 3144 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 83 PID 4844 wrote to memory of 3144 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 83 PID 4844 wrote to memory of 3144 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 83 PID 4844 wrote to memory of 1764 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 85 PID 4844 wrote to memory of 1764 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 85 PID 4844 wrote to memory of 1764 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 85 PID 4844 wrote to memory of 2440 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 87 PID 4844 wrote to memory of 2440 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 87 PID 4844 wrote to memory of 2440 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 87 PID 4844 wrote to memory of 3180 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 89 PID 4844 wrote to memory of 3180 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 89 PID 4844 wrote to memory of 3180 4844 9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe 89 PID 2440 wrote to memory of 3680 2440 cmd.exe 91 PID 2440 wrote to memory of 3680 2440 cmd.exe 91 PID 2440 wrote to memory of 3680 2440 cmd.exe 91 PID 1764 wrote to memory of 3928 1764 cmd.exe 92 PID 1764 wrote to memory of 3928 1764 cmd.exe 92 PID 1764 wrote to memory of 3928 1764 cmd.exe 92 PID 4872 wrote to memory of 64 4872 msiexec.exe 94 PID 4872 wrote to memory of 64 4872 msiexec.exe 94 PID 4872 wrote to memory of 64 4872 msiexec.exe 94 PID 3928 wrote to memory of 3392 3928 inlC039.tmp 103 PID 3928 wrote to memory of 3392 3928 inlC039.tmp 103 PID 3928 wrote to memory of 3392 3928 inlC039.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe"C:\Users\Admin\AppData\Local\Temp\9078bf7eb911ad769aea709a95e85605e5290c634b67444c6e704b536bea7e6e.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat" "2⤵PID:1440
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\insBB27.tmp.msi" /quiet2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\inlC039.tmpC:\Users\Admin\AppData\Local\Temp\inlC039.tmp cdf1912.tmp3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inlC039.tmp > nul4⤵PID:3392
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"3⤵
- Drops file in Windows directory
PID:3680
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9078BF~1.EXE > nul2⤵PID:3180
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0949A961EC0687D474E5AFFB68241F5C2⤵PID:64
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
765B
MD5a4a4219ce5fdbaf2864b04ca4e453ac9
SHA198bf1383e8b2f4db0388ee139ae7fe06ff7a67a9
SHA2567ce64a6d79d1772713cf59d6575aec39f9fa00690d4c84cd2f160081b0d412c6
SHA51222f5668719a58a4c1692ceb8aae48af9d5a53527d96431410587fa1f3f67ec9b5f0660c87fa9d931343e1be9b0f56f03c3fcd431cc2d67b104450b2ef792baa8
-
Filesize
57.2MB
MD582aac2c98a7a7b08b626a5c4ab5967e0
SHA158295067345d2ea2188f337e4c6d0bc385451d39
SHA256935fadff5604356a9e20b227fe3c86731ac3ebc51d8891042d12d6e0473d5f2c
SHA512c1919395cb0d25a31591856a230bb61745d3483b19f720520c16fa7caf414e0eb2357c238be5aec4dc03ff4c5dba636cc0eae461ca85d47231311f7e9adc6332
-
Filesize
57.2MB
MD582aac2c98a7a7b08b626a5c4ab5967e0
SHA158295067345d2ea2188f337e4c6d0bc385451d39
SHA256935fadff5604356a9e20b227fe3c86731ac3ebc51d8891042d12d6e0473d5f2c
SHA512c1919395cb0d25a31591856a230bb61745d3483b19f720520c16fa7caf414e0eb2357c238be5aec4dc03ff4c5dba636cc0eae461ca85d47231311f7e9adc6332
-
Filesize
57.3MB
MD5fee989e9a9d8b6b6f4facb1cf31acf11
SHA1a66b2e856d0f92fa68ec1cca5310c053e1f67a5c
SHA2569ed158744aaedf849daa00662741a0b6b4a05f6566cd97c5921ed30ae7577491
SHA5121d8071615826ed4c7f89bc60208a14888ee63fe5ae4ba8d98ff59113ae407da7d7b1614f369482591fa5aa502edd9543946741d0d804b9deb5505ddf4e5723c7
-
Filesize
57B
MD5b69c12220d484db66d63a83eed846295
SHA126bdacb1f0d43035c83a408f116ebd72f7ae002d
SHA25694f4d16a29ca949e6f130b4eae60bdb96773505ff1c2064d406ed63621e80a81
SHA512f967ed54f47530b1186de15c82f6a188c4b58403b2ad5cc446b340ee0f49eb91372153d62609f77fe63e8143b5ba0d4f0c726380ae90771dc0c8f608adf02c55
-
Filesize
26B
MD549cb42ed4e90c1df7d7bd69348b4cac9
SHA10e06e4b6201177a24c304b02fb052d6f5393f314
SHA2560fe404e349177b204405181c00c357c1ac82cbd04ca450e2faebeead2ef54b6d
SHA512e42e038acbbf58c17a2fd0353b14f65d360ec886aafdade4e1d71ca45f9852d01a080a9d09676008aa15296a4ac87eb1ff6e29523d057f1d4452e21776cbc319
-
Filesize
98B
MD58663de6fce9208b795dc913d1a6a3f5b
SHA1882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA2562909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA5129381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688
-
Filesize
425B
MD5da68bc3b7c3525670a04366bc55629f5
SHA115fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA25673f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA5126fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0