fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4.exe
Size

191KB
MD5

9db29b9f2b0d2242fdbd13cd03668f12
SHA1

47e199c8f4cda8857cf6d808b064a533378b33e3
SHA256

fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4
SHA512

ad708161ee4c3fda6bc1fefee0cea0aa17b972f46d24df6405b52bf430c103b0e043a83a5bcf67c1b5aa888f54cb505baffdf9f91f0708d03e555a00b60e7296
SSDEEP

3072:UlzooWRFJOQtiQ/5JH/TmcPRl/N/jqa+alSPzsJKlxQbcJA22Aw:qzyUuqcI3OJKl6bY2

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\svhost = "C:\\Windows\\svchost.exe"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4936	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4.exe
File opened for modification	C:\Windows\svchost.exe	fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4936	3564	fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4.exe	80
PID 3564 wrote to memory of 4936	3564	fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4.exe	80
PID 3564 wrote to memory of 4936	3564	fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4.exe	80

C:\Users\Admin\AppData\Local\Temp\fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4.exe
"C:\Users\Admin\AppData\Local\Temp\fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe"
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  PID:4936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe

Filesize
191KB

MD5
9db29b9f2b0d2242fdbd13cd03668f12

SHA1
47e199c8f4cda8857cf6d808b064a533378b33e3

SHA256
fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4

SHA512
ad708161ee4c3fda6bc1fefee0cea0aa17b972f46d24df6405b52bf430c103b0e043a83a5bcf67c1b5aa888f54cb505baffdf9f91f0708d03e555a00b60e7296

Download Submit
C:\Windows\svchost.exe

Filesize
191KB

MD5
9db29b9f2b0d2242fdbd13cd03668f12

SHA1
47e199c8f4cda8857cf6d808b064a533378b33e3

SHA256
fda232cea205186e239ad5c068f431c4f52c1e13842a41f720dc11bd0da133d4

SHA512
ad708161ee4c3fda6bc1fefee0cea0aa17b972f46d24df6405b52bf430c103b0e043a83a5bcf67c1b5aa888f54cb505baffdf9f91f0708d03e555a00b60e7296

Download Submit