Analysis
-
max time kernel
155s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 12:28
Static task
static1
Behavioral task
behavioral1
Sample
3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe
Resource
win7-20220812-en
General
-
Target
3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe
-
Size
352KB
-
MD5
cd5033888dd7ee1ccab2ca5dc6e08f11
-
SHA1
041a2832b6f88a8eb5f58cea0c6da87e5639a8a5
-
SHA256
3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83
-
SHA512
4740129d37b9d4b6f75eeaa47bba84fededb4489a46ee111f72c0a444697d07d0c022d049328ca523bb4eea426f8ee3d3737cb954dfd51598de18a3dd5084a94
-
SSDEEP
6144:PBnyL0v+1l/iTZ5zA/KHJyroHK6T9Pe31ILRlG+tKgZBEypNQr8:44v+7is/KHEIeGrG1gZ+6U8
Malware Config
Extracted
formbook
m8on
5RDJg6PD8b8/lg==
z+6tEasghyxTRlAm8HeF0rCTn4HchcIaMA==
hY6JDp4OeFclIzg=
2n/nBKEMvlUg
TQnCBZUdgFclIzg=
RoBCgR5KI0aa5rrVt24Bn6zPykA=
sEG8UAyhFJVnVdUp6H2hncgEew==
g0futs/jzu99IJgM4A==
YifLj6YLs642v7/UXiXF
QN+IobKqkqUncrCskFgnesA=
/cRBHQXRQVgBWgiVOUed3g==
2OOiy0XNMs/jyhGljU3Y
EMu0wdnLtMtMj+2FSr8=
04k8CS/jXna1wGgYsjVaGck=
ixeHKD9bM9/N24ED8merIyfKD1g=
ARzXDqXXoaUyQdMl9Q==
RAOPg5J5ex0kS04Z
gbJpkQiD2oNFlymBQBFguUYz
hosWDpYs4Hg5
xIE4IzUZ7xKqPJgN6A==
eZlWsb154OhgGKD5xowz1w==
D0P9rr3SyMo9oVThr2OpncgEew==
s2e0ka+ogJIzskWaOUed3g==
AzA3a6EYhi6AaFmSBdgs7ogRUmqyFA==
dEHvlXX8VOuW9S8=
GMt4Q119UPjKmu2FSr8=
y+Cch7nF5bxLlw==
3u2p7XT5aF//aBuZOUed3g==
WfVmzsqS9JBkS+RfKuYb30nG6D0ShJQ=
ThKVJ9q05YY6gA==
rrhlzH71alclIzg=
rdG2JBTNJs/r6QQKtahXyQ==
E7cbt9Lz29pjz23Bo1gnesA=
97U8v8KmDLd25dkI8A==
nVQlBJAUfFclIzg=
vM1XQr4F849j2OLGiE4CGIVgec/nFvie
Fi0boULFJBe2MTcR
0o0tVt0B8Ic3k41RMbPq+nSZab2k
gg8eEiER5bxLlw==
w1rDKrUTdQvnw+nYolgnesA=
pVPH4F7FK8bhtPPUXiXF
ONdKs6O/uM45u8fUXiXF
p2MTcya5DptVusKZikWcncgEew==
WuhpPZ35YlclIzg=
oXmiSraV6zNBLjE=
/ZsO9Guri7dJ0XDnr3sIBckgUmqyFA==
lnFUWGpcIgLudcVKOKg=
e/4T7759EYM5gA==
hDSl0BHlyd5c1VScOUed3g==
0pUAHbtBpkRFF0RIH/Gasjwtf3DKaboXLg==
7pjf9AUH5bxLlw==
ZyDVpdIA45ifnu2FSr8=
OctAyWLELi7OLdxJHu6bISfKD1g=
FizptjiRdY0kS04Z
OO5u32q/Zv3nssVKOKg=
Er5/Py8RLfQ8
/TQtKCwO9AyJ0FSvhln5az4kc3xShcIaMA==
+BULkIY5lqr7PJgN6A==
OmBbYnZ1S/xCCS8xJLY=
hOLPV3wy5bxLlw==
T93q5QAE5bxLlw==
7alXo+LCpsgrijucOUed3g==
kbW5iL3I5bxLlw==
0A3yi61r4f5OT/aBWPIG2poMUmqyFA==
yallports.world
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ltqqhtcad.exeltqqhtcad.exepid process 1796 ltqqhtcad.exe 5032 ltqqhtcad.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ltqqhtcad.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ltqqhtcad.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ltqqhtcad.exeltqqhtcad.exesystray.exedescription pid process target process PID 1796 set thread context of 5032 1796 ltqqhtcad.exe ltqqhtcad.exe PID 5032 set thread context of 2692 5032 ltqqhtcad.exe Explorer.EXE PID 1236 set thread context of 2692 1236 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
ltqqhtcad.exesystray.exepid process 5032 ltqqhtcad.exe 5032 ltqqhtcad.exe 5032 ltqqhtcad.exe 5032 ltqqhtcad.exe 5032 ltqqhtcad.exe 5032 ltqqhtcad.exe 5032 ltqqhtcad.exe 5032 ltqqhtcad.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2692 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
ltqqhtcad.exeltqqhtcad.exesystray.exepid process 1796 ltqqhtcad.exe 5032 ltqqhtcad.exe 5032 ltqqhtcad.exe 5032 ltqqhtcad.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe 1236 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ltqqhtcad.exesystray.exedescription pid process Token: SeDebugPrivilege 5032 ltqqhtcad.exe Token: SeDebugPrivilege 1236 systray.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exeltqqhtcad.exeExplorer.EXEsystray.exedescription pid process target process PID 3592 wrote to memory of 1796 3592 3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe ltqqhtcad.exe PID 3592 wrote to memory of 1796 3592 3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe ltqqhtcad.exe PID 3592 wrote to memory of 1796 3592 3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe ltqqhtcad.exe PID 1796 wrote to memory of 5032 1796 ltqqhtcad.exe ltqqhtcad.exe PID 1796 wrote to memory of 5032 1796 ltqqhtcad.exe ltqqhtcad.exe PID 1796 wrote to memory of 5032 1796 ltqqhtcad.exe ltqqhtcad.exe PID 1796 wrote to memory of 5032 1796 ltqqhtcad.exe ltqqhtcad.exe PID 2692 wrote to memory of 1236 2692 Explorer.EXE systray.exe PID 2692 wrote to memory of 1236 2692 Explorer.EXE systray.exe PID 2692 wrote to memory of 1236 2692 Explorer.EXE systray.exe PID 1236 wrote to memory of 3696 1236 systray.exe Firefox.exe PID 1236 wrote to memory of 3696 1236 systray.exe Firefox.exe PID 1236 wrote to memory of 3696 1236 systray.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe"C:\Users\Admin\AppData\Local\Temp\3305e6f47a497c5a157f92bb6a062af2a257121e93e0914bd771f09d550f5a83.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exe"C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exe" C:\Users\Admin\AppData\Local\Temp\xwauktnimxi.e3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exe"C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exe" C:\Users\Admin\AppData\Local\Temp\xwauktnimxi.e4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gajdq.sgFilesize
185KB
MD53b61a4a244536dd018bf2690c177b521
SHA131daa9dbcebf8661bce00fa2e377e2103446fad1
SHA2562ee93016d0669052bbed7a67c87722931b5a055effcb0002db7da09d017d7847
SHA512c9edfd94cd3c88482b2fc16c5d1ad44e5ec85aee9b8273143db48f4e63424101e773bb29d0d7d8a9affe9889cc840374483b7c627a36db53bccd6aa92e00d00d
-
C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exeFilesize
320KB
MD53c9863c51ab9328b84f17273c6742534
SHA18d4e4ce2acc2fc179e29e8b8d8479c6b1fb5403b
SHA256fc93bc25d9d29ec8a80d81ea5c338567f92bbf8f5c1db434c1ecf9741a4733e6
SHA5124b793a0be71c38eda977295e698b5f08d069add8a3ab13fb9954021fee554e52d673a5ab4d87f20cbe4f1857a03eb69ede420d0156c4c464a33598a5609ea61c
-
C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exeFilesize
320KB
MD53c9863c51ab9328b84f17273c6742534
SHA18d4e4ce2acc2fc179e29e8b8d8479c6b1fb5403b
SHA256fc93bc25d9d29ec8a80d81ea5c338567f92bbf8f5c1db434c1ecf9741a4733e6
SHA5124b793a0be71c38eda977295e698b5f08d069add8a3ab13fb9954021fee554e52d673a5ab4d87f20cbe4f1857a03eb69ede420d0156c4c464a33598a5609ea61c
-
C:\Users\Admin\AppData\Local\Temp\ltqqhtcad.exeFilesize
320KB
MD53c9863c51ab9328b84f17273c6742534
SHA18d4e4ce2acc2fc179e29e8b8d8479c6b1fb5403b
SHA256fc93bc25d9d29ec8a80d81ea5c338567f92bbf8f5c1db434c1ecf9741a4733e6
SHA5124b793a0be71c38eda977295e698b5f08d069add8a3ab13fb9954021fee554e52d673a5ab4d87f20cbe4f1857a03eb69ede420d0156c4c464a33598a5609ea61c
-
C:\Users\Admin\AppData\Local\Temp\xwauktnimxi.eFilesize
5KB
MD518d463ab2493a9795fcff9238271be94
SHA1bdb2d8cb8fca102acbf35859dfeb9e0f1eddd967
SHA25606c666fc77051482e96fac9c986b3b95f22d3bc3a3de7d27045256a410c3553a
SHA512085ff5b1da065e416e49e30c229acba2c33e220f83078bd30d5e16e4ce6462408bba937b2564518a1db45c858c531dbe762dae0f3f66a6bd3338b2d99b13c58e
-
memory/1236-151-0x0000000000E90000-0x0000000000EBD000-memory.dmpFilesize
180KB
-
memory/1236-149-0x0000000002BB0000-0x0000000002C3F000-memory.dmpFilesize
572KB
-
memory/1236-144-0x0000000000000000-mapping.dmp
-
memory/1236-146-0x0000000000E90000-0x0000000000EBD000-memory.dmpFilesize
180KB
-
memory/1236-145-0x0000000000760000-0x0000000000766000-memory.dmpFilesize
24KB
-
memory/1236-147-0x0000000002E60000-0x00000000031AA000-memory.dmpFilesize
3.3MB
-
memory/1796-132-0x0000000000000000-mapping.dmp
-
memory/2692-152-0x0000000008CA0000-0x0000000008DC4000-memory.dmpFilesize
1.1MB
-
memory/2692-148-0x0000000008700000-0x0000000008817000-memory.dmpFilesize
1.1MB
-
memory/2692-150-0x0000000008CA0000-0x0000000008DC4000-memory.dmpFilesize
1.1MB
-
memory/2692-143-0x0000000008700000-0x0000000008817000-memory.dmpFilesize
1.1MB
-
memory/5032-137-0x0000000000000000-mapping.dmp
-
memory/5032-142-0x0000000000490000-0x00000000004A0000-memory.dmpFilesize
64KB
-
memory/5032-141-0x0000000000A20000-0x0000000000D6A000-memory.dmpFilesize
3.3MB
-
memory/5032-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/5032-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB