b37edff0dbb286c487d7a95db2238b22abc5e404cda5480495cbdb77f2788c69

Analysis

max time kernel
69s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2022, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1adc80d25b6ff4aba3c852f0c1ed59cd.exe
Size 74KB
Sample221212-vx44dsca54
SHA256 b37edff0dbb286c487d7a95db2238b22abc5e404cda5480495cbdb77f2788c69
MD5 1adc80d25b6ff4aba3c852f0c1ed59cd
SHA1 22e47cb2a1a10e307b375d5a483894579f487402
SHA512 cabc4b15ff9beccf30c9df917f430df26b6e076e19b8f5bff8b2e6da192f9f602b30e43af1568d89e5399deb267084ea8c1f6f217009931bfd189b4db3783718
SSDEEP 1536:8RdPEKf4KRG68C1W1U+Dj3333333333333T6XQM+H2yxgHz19T:K5EKf4KRG68C1W1U+Dj333333333333o
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1adc80d25b6ff4aba3c852f0c1ed59cd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 752	4460	1adc80d25b6ff4aba3c852f0c1ed59cd.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4856	powershell.exe
4856	powershell.exe
752	AppLaunch.exe
752	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	1adc80d25b6ff4aba3c852f0c1ed59cd.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	752	AppLaunch.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4856	4460	1adc80d25b6ff4aba3c852f0c1ed59cd.exe	83
PID 4460 wrote to memory of 4856	4460	1adc80d25b6ff4aba3c852f0c1ed59cd.exe	83
PID 4460 wrote to memory of 752	4460	1adc80d25b6ff4aba3c852f0c1ed59cd.exe	92
PID 4460 wrote to memory of 752	4460	1adc80d25b6ff4aba3c852f0c1ed59cd.exe	92
PID 4460 wrote to memory of 752	4460	1adc80d25b6ff4aba3c852f0c1ed59cd.exe	92
PID 4460 wrote to memory of 752	4460	1adc80d25b6ff4aba3c852f0c1ed59cd.exe	92
PID 4460 wrote to memory of 752	4460	1adc80d25b6ff4aba3c852f0c1ed59cd.exe	92
PID 4460 wrote to memory of 752	4460	1adc80d25b6ff4aba3c852f0c1ed59cd.exe	92

C:\Users\Admin\AppData\Local\Temp\1adc80d25b6ff4aba3c852f0c1ed59cd.exe
"C:\Users\Admin\AppData\Local\Temp\1adc80d25b6ff4aba3c852f0c1ed59cd.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANAAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-144-0x00007FF883FC0000-0x00007FF884A81000-memory.dmp

Download

memory/752-143-0x00007FF883FC0000-0x00007FF884A81000-memory.dmp

Download

memory/752-140-0x0000000140000000-0x000000014007C000-memory.dmp

Download

memory/4460-133-0x00007FF883FC0000-0x00007FF884A81000-memory.dmp

Download

memory/4460-134-0x0000015DB0DE0000-0x0000015DB0E02000-memory.dmp

Download

memory/4460-132-0x0000015DAF090000-0x0000015DAF0A8000-memory.dmp

Download

memory/4460-137-0x00007FF883FC0000-0x00007FF884A81000-memory.dmp

Download

memory/4460-142-0x00007FF883FC0000-0x00007FF884A81000-memory.dmp

Download

memory/4856-139-0x00007FF883FC0000-0x00007FF884A81000-memory.dmp

Download

memory/4856-138-0x00007FF883FC0000-0x00007FF884A81000-memory.dmp

Download

memory/4856-136-0x00007FF883FC0000-0x00007FF884A81000-memory.dmp

Download