d265e4a4cad9e1937d41cb1d5f38cb6afe90c429c6b708e01f147d69fd5b6056

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2022, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6b19b2656d16cc4821210229af2d40f.exe
Size 117KB
Sample221212-vx44dsca53
SHA256 d265e4a4cad9e1937d41cb1d5f38cb6afe90c429c6b708e01f147d69fd5b6056
MD5 b6b19b2656d16cc4821210229af2d40f
SHA1 4ce2dea4227cab91b614d26e9f1ed5c44c875228
SHA512 defb70d9ca4b05c9b785910881a089b752a7139069d47c293b4720c1e08614477dcf68bd07d292c5aa305831c7aa86062d97200c5d80975bb2231f6a861e23b2
SSDEEP 1536:O/bvMgGiI9Y7DXcGiIzXGVYB6Ju15gVA6F2DU7mVcl:O/bEFDa7zcGi848Y
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	b6b19b2656d16cc4821210229af2d40f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puttynew = "\"C:\\Users\\Admin\\AppData\\Roaming\\Putty\\puttynew.exe\""	b6b19b2656d16cc4821210229af2d40f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2352 set thread context of 3476	2352	b6b19b2656d16cc4821210229af2d40f.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2180	powershell.exe
2180	powershell.exe
4880	powershell.exe
4880	powershell.exe
3476	AppLaunch.exe
3476	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	2352	b6b19b2656d16cc4821210229af2d40f.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	3476	AppLaunch.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2180	2352	b6b19b2656d16cc4821210229af2d40f.exe	80
PID 2352 wrote to memory of 2180	2352	b6b19b2656d16cc4821210229af2d40f.exe	80
PID 2352 wrote to memory of 4880	2352	b6b19b2656d16cc4821210229af2d40f.exe	82
PID 2352 wrote to memory of 4880	2352	b6b19b2656d16cc4821210229af2d40f.exe	82
PID 2352 wrote to memory of 3476	2352	b6b19b2656d16cc4821210229af2d40f.exe	91
PID 2352 wrote to memory of 3476	2352	b6b19b2656d16cc4821210229af2d40f.exe	91
PID 2352 wrote to memory of 3476	2352	b6b19b2656d16cc4821210229af2d40f.exe	91
PID 2352 wrote to memory of 3476	2352	b6b19b2656d16cc4821210229af2d40f.exe	91
PID 2352 wrote to memory of 3476	2352	b6b19b2656d16cc4821210229af2d40f.exe	91
PID 2352 wrote to memory of 3476	2352	b6b19b2656d16cc4821210229af2d40f.exe	91

C:\Users\Admin\AppData\Local\Temp\b6b19b2656d16cc4821210229af2d40f.exe
"C:\Users\Admin\AppData\Local\Temp\b6b19b2656d16cc4821210229af2d40f.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-Date
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d078101d896007ff20c5735411917d308f8d27cb54e5289b7b605f73986c9ab0
MD5 704162a7d4c00eceed73583a5db40400
SHA1 cff30c76e4264dea03b75672298401b5378ddcff
SHA512 d0b5de843e9fb1abad42f6a225d1e71c9c5e6768989508df8007f5ceb55b77be0665d2d84a296bb2da9ecbf6cda002f6173ec34348ae78a2089c440686a4bca0
MD5 SHA1 SHA512

Submit Download

memory/2180-136-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Download

memory/2180-137-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Download

memory/2180-134-0x0000026FA80B0000-0x0000026FA80D2000-memory.dmp

Download

memory/2352-132-0x0000025CA61C0000-0x0000025CA61E0000-memory.dmp

Download

memory/2352-135-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Download

memory/2352-142-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Download

memory/2352-147-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Download

memory/3476-149-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Download

memory/3476-148-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Download

memory/3476-145-0x0000000140000000-0x000000014007C000-memory.dmp

Download

memory/4880-141-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Download

memory/4880-144-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Download

memory/4880-143-0x00007FFE53930000-0x00007FFE543F1000-memory.dmp

Download