512041d2cf26aa8cdd11e5c0edd3a5047e887d18204e554875026ae850a49ffe

Analysis

max time kernel
205s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2022 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31072022-2.exe
Size

757KB
MD5

865ffbbf9721906c2f4802622261d34c
SHA1

04c04fb395f15820a5b22b6a5d0b377d04d95f98
SHA256

512041d2cf26aa8cdd11e5c0edd3a5047e887d18204e554875026ae850a49ffe
SHA512

84077e4b14367d5198b1d43a89963313395569fc3996dde3d04b693aabeccb0ae4dd055f7b51d5111e261ebde5d5188d2cff5dd4b6ed7606afa12ee538805c09
SSDEEP

12288:8wlhmomPZefBT2BRF0DKTNOJrKvG4R+0/kkUpsixfmAWwPtqvyuP/F:IomxiBT2BRF0CNO0vb+kUp5nnQFXF

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

31072022-2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	31072022-2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4648 schtasks.exe

pid	process
4648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

31072022-2.exepowershell.exe

pid	process
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
968	powershell.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe
3052	31072022-2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

31072022-2.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3052 31072022-2.exe
Token: SeDebugPrivilege 968 powershell.exe

description	pid	process
Token: SeDebugPrivilege	3052	31072022-2.exe
Token: SeDebugPrivilege	968	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

31072022-2.exe

description	pid	process	target process
PID 3052 wrote to memory of 968	3052	31072022-2.exe	powershell.exe
PID 3052 wrote to memory of 968	3052	31072022-2.exe	powershell.exe
PID 3052 wrote to memory of 968	3052	31072022-2.exe	powershell.exe
PID 3052 wrote to memory of 4648	3052	31072022-2.exe	schtasks.exe
PID 3052 wrote to memory of 4648	3052	31072022-2.exe	schtasks.exe
PID 3052 wrote to memory of 4648	3052	31072022-2.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\31072022-2.exe
"C:\Users\Admin\AppData\Local\Temp\31072022-2.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jPjTWeqDDTDx.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jPjTWeqDDTDx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4EF1.tmp"
2⤵
- Creates scheduled task(s)
PID:4648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4EF1.tmp
Filesize
1KB

MD5
874aa832bc5ac8a0a53cf593c3aa696e

SHA1
fcaeb7bc09b51ad6716ca427dcaea55809f39bec

SHA256
d8320b8db0e44309cde863e4a78c040694c94c194dcf0742e6f497ed130c105c

SHA512
561bdfa710c68d1f0fee5bddf8d19b5bf6c7715de0ae90622945c9433127c842932fdbbbabc37fc4b68ba80dcb74ed5f3073d09e7b9b65a7b260c15d1358c7e6

Download Submit
memory/968-137-0x0000000000000000-mapping.dmp

Download
memory/968-138-0x00000000027E0000-0x0000000002816000-memory.dmp

Filesize
216KB

Download
memory/968-139-0x00000000052B0000-0x00000000058D8000-memory.dmp

Filesize
6.2MB

Download
memory/968-141-0x0000000005230000-0x0000000005252000-memory.dmp

Filesize
136KB

Download
memory/968-143-0x0000000005990000-0x00000000059F6000-memory.dmp

Filesize
408KB

Download
memory/3052-132-0x0000000000510000-0x00000000005D2000-memory.dmp

Filesize
776KB

Download
memory/3052-133-0x0000000005610000-0x0000000005BB4000-memory.dmp

Filesize
5.6MB

Download
memory/3052-134-0x0000000005200000-0x0000000005292000-memory.dmp

Filesize
584KB

Download
memory/3052-135-0x00000000051B0000-0x00000000051BA000-memory.dmp

Filesize
40KB

Download
memory/3052-136-0x0000000007450000-0x00000000074EC000-memory.dmp

Filesize
624KB

Download
memory/4648-140-0x0000000000000000-mapping.dmp

Download