f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe
Size

654KB
MD5

d1d7aadd8bf387753bd6c7501d943696
SHA1

7f8c251e26eeb2a932fbac229bfd471e053e4189
SHA256

f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5
SHA512

7f62d94f93de037c6abc36a7b971914409c1796a20dd20c67f43f7d6117f523f7a267a6e20120cb5faff94fc81a1b36c8381a8ccf1dc0a1f5b4208df42cd6430
SSDEEP

12288:h6Wq4aaE6KwyF5L0Y2D1PqLwelzrCW8Vwj/8Snw5CmzgpNrX:3thEVaPqLwex8e/dwEmsX

Score

8^/10

evasion persistence upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2260	readme.exe
4548	svchost.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1380	netsh.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5036-138-0x0000000000400000-0x00000000004FA000-memory.dmp	upx
behavioral2/memory/5036-147-0x0000000000400000-0x00000000004FA000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	readme.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read.vbs	WScript.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\read = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\read.vbs\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\read = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\read.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\23556fb1360f366337f97c924e76ead3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\23556fb1360f366337f97c924e76ead3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5036-138-0x0000000000400000-0x00000000004FA000-memory.dmp	autoit_exe
behavioral2/memory/5036-147-0x0000000000400000-0x00000000004FA000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	readme.exe
Token: SeDebugPrivilege	4548	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 2260	5036	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	81
PID 5036 wrote to memory of 2260	5036	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	81
PID 5036 wrote to memory of 2260	5036	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	81
PID 5036 wrote to memory of 5088	5036	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	82
PID 5036 wrote to memory of 5088	5036	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	82
PID 5036 wrote to memory of 5088	5036	f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe	82
PID 2260 wrote to memory of 4548	2260	readme.exe	83
PID 2260 wrote to memory of 4548	2260	readme.exe	83
PID 2260 wrote to memory of 4548	2260	readme.exe	83
PID 4548 wrote to memory of 1380	4548	svchost.exe	84
PID 4548 wrote to memory of 1380	4548	svchost.exe	84
PID 4548 wrote to memory of 1380	4548	svchost.exe	84

C:\Users\Admin\AppData\Local\Temp\f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe
"C:\Users\Admin\AppData\Local\Temp\f0c44b35a38cc014aae4ab622cad7c23bab541160053770188fe7067905462c5.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\readme.exe
  C:\Users\Admin\AppData\Local\Temp/readme.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:1380
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\read.vbs"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  PID:5088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\read.vbs

Filesize
108KB

MD5
60ce7fdcf0debaab00b74c84d5295c1f

SHA1
f76301f76220acd3611c14b1b6310c5600bb4497

SHA256
77c14d3a8a92498e479cb579e5cf0f0a397941f0266f1f178bc2a11a88c42cad

SHA512
58f828d8c124c0b1ab23830fc5f103a793ab31dddb9138dce2f1e21197cf027952da4358c54d89776c713edb12e83e93e0ca0709bb95aacbc61d1111f5112829

Download Submit
C:\Users\Admin\AppData\Local\Temp\readme.exe

Filesize
372KB

MD5
b16682ddf9bb23946228262d2cd37d55

SHA1
650040332e8fe8d34fea5877a51695b2ce4a4e86

SHA256
42c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e

SHA512
a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933

Download Submit
C:\Users\Admin\AppData\Local\Temp\readme.exe

Filesize
372KB

MD5
b16682ddf9bb23946228262d2cd37d55

SHA1
650040332e8fe8d34fea5877a51695b2ce4a4e86

SHA256
42c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e

SHA512
a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
372KB

MD5
b16682ddf9bb23946228262d2cd37d55

SHA1
650040332e8fe8d34fea5877a51695b2ce4a4e86

SHA256
42c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e

SHA512
a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
372KB

MD5
b16682ddf9bb23946228262d2cd37d55

SHA1
650040332e8fe8d34fea5877a51695b2ce4a4e86

SHA256
42c990f46bcc15496dd3b428a07260d705ac98172f6c45bfc107b86e2803fe3e

SHA512
a8511c74c30ad9b3532efd423bdda9d8147072dba23aa6ee066fb4d1e466240a477993164a1d8a7cbf4cfdf79698617ad8e3c38096dba8a4e6faac2140aa6933

Download Submit
memory/2260-174-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-141-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-143-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-146-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-145-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-148-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-149-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-153-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-140-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-150-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-152-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-154-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-155-0x0000000073B60000-0x0000000074111000-memory.dmp

Filesize
5.7MB

Download
memory/2260-156-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-157-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-158-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-159-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-161-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-160-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-162-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-163-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-164-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-165-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-166-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-167-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-168-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-169-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-170-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-172-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-171-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-173-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-177-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-175-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-142-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-176-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-194-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-179-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-180-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-181-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-182-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-183-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-184-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-185-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-186-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-188-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-187-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-191-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-192-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-178-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-189-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-190-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-193-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-197-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-198-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-196-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-195-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-199-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-200-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-201-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-202-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-203-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-254-0x0000000073B60000-0x0000000074111000-memory.dmp

Filesize
5.7MB

Download
memory/2260-139-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/2260-135-0x00000000001D0000-0x00000000001FC000-memory.dmp

Filesize
176KB

Download
memory/4548-285-0x0000000073B60000-0x0000000074111000-memory.dmp

Filesize
5.7MB

Download
memory/4548-364-0x0000000073B60000-0x0000000074111000-memory.dmp

Filesize
5.7MB

Download
memory/5036-138-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/5036-147-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download