8ecb6213f91889acb55033a6267b29e1074afdc61aeecc25564bd844068c1241

Analysis

max time kernel
152s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ecb6213f91889acb55033a6267b29e1074afdc61aeecc25564bd844068c1241.exe
Size 911KB
Sample221206-nnk6lade37
SHA256 8ecb6213f91889acb55033a6267b29e1074afdc61aeecc25564bd844068c1241
MD5 2adca17e1d67dc73dbbbc2403febc01c
SHA1 ff7b451add7a8010360b65db042c4604920867ab
SHA512 e9cbbab767d55038be357cf7aff32b9af8b65d8be32b9436613454d2ffb72bb85a50e325101c937776f43eeecf4424dc2cf98ad55c318ae07714b9d01cb9759d
SSDEEP 12288:/7aPOdgWZXNb/Me6zhS6HQ+68mhZA7nvpD2u5n9C95IkH5EhGw+LHjgoxl1eRdZq:DWcXNT4tQx8mh6zhDJMxZx35cjZGR5h
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1200	sheruser.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	8ecb6213f91889acb55033a6267b29e1074afdc61aeecc25564bd844068c1241.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sheruser = "C:\\windows\\system32\\sheruser.exe"	8ecb6213f91889acb55033a6267b29e1074afdc61aeecc25564bd844068c1241.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\sheruser.exe	8ecb6213f91889acb55033a6267b29e1074afdc61aeecc25564bd844068c1241.exe
File created	C:\windows\SysWOW64\logo12\10\2022.cyb	sheruser.exe
File created	C:\windows\SysWOW64\logo12\11\2022.cyb	sheruser.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1200	sheruser.exe
1200	sheruser.exe
1200	sheruser.exe
1200	sheruser.exe
1200	sheruser.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1200	sheruser.exe
1200	sheruser.exe
1200	sheruser.exe
1200	sheruser.exe
1200	sheruser.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1200	1092	8ecb6213f91889acb55033a6267b29e1074afdc61aeecc25564bd844068c1241.exe	79
PID 1092 wrote to memory of 1200	1092	8ecb6213f91889acb55033a6267b29e1074afdc61aeecc25564bd844068c1241.exe	79
PID 1092 wrote to memory of 1200	1092	8ecb6213f91889acb55033a6267b29e1074afdc61aeecc25564bd844068c1241.exe	79

C:\Users\Admin\AppData\Local\Temp\8ecb6213f91889acb55033a6267b29e1074afdc61aeecc25564bd844068c1241.exe
"C:\Users\Admin\AppData\Local\Temp\8ecb6213f91889acb55033a6267b29e1074afdc61aeecc25564bd844068c1241.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1092
- C:\windows\SysWOW64\sheruser.exe
  "C:\windows\system32\sheruser.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sheruser.exe

Path C:\Windows\SysWOW64\sheruser.exe
Size 512KB
SHA256 af6ba2f0fe128df183e6ead783ffae38a2e2c06411f20e5ca3cf47cde6eba765
MD5 e36fdb43a7b9487e7897700317a10439
SHA1 4f4b86f27034728df09f55605723c3c3df2f368e
SHA512 809616a565545c8576b5460d6f78b2999fb88e28d8f9cdeccb881f9cb79a8fd2880039583ffe154a03aed8459d364782a9d37fe3223a41ccb668e94c7cfeb0d5
SSDEEP 12288:a5n9C95IkH5EhGw+LHjgoxl1eRdZGRo+KiH:8MxZx35cjZGR5h
MD5 SHA1 SHA512 SSDEEP

Submit Download