6bb58cf16e20a15c24a100a5464e45d730ca6a82a5c839f0aa80bfef76feccd6

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13/12/2022, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install-win64-11.5.8.exe
Size 751KB
Sample221213-v65fhsfc73
SHA256 6bb58cf16e20a15c24a100a5464e45d730ca6a82a5c839f0aa80bfef76feccd6
MD5 92001e1bc413b90de8af89dba3b63dda
SHA1 b092a1202a2008fbbeef9f7ba43a54aab0ba2738
SHA512 bca2a5d2dcc069ef533d879b8103f1e47faefbfd03c3a067d3f2804af1a90ebb1eae2bc55bab73372bdc42f2ab28982e522f0bc237b4cc5341ef39a75146375d
SSDEEP 3072:kahKyd2n3175939OLVOg7g5zTQpj4ptedjn2OMvEeC:kahOVmVJEJTQW3epn2O
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1880	FORGET~2.EXE
3196	FORGET~2.EXE
2888	FORGET~2.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	FORGET~2.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	install-win64-11.5.8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	install-win64-11.5.8.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{65953999-EEB2-40A1-9BB3-06F6936D9810}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9E468B30-DB86-4D35-932E-7EAAB374F213}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1880 set thread context of 2888	1880	FORGET~2.EXE	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5016	powershell.exe
5016	powershell.exe
1880	FORGET~2.EXE
1880	FORGET~2.EXE
2888	FORGET~2.EXE
2888	FORGET~2.EXE
2888	FORGET~2.EXE
2888	FORGET~2.EXE
2888	FORGET~2.EXE
2888	FORGET~2.EXE
2888	FORGET~2.EXE
2888	FORGET~2.EXE
2888	FORGET~2.EXE
2888	FORGET~2.EXE
2888	FORGET~2.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	FORGET~2.EXE
Token: SeDebugPrivilege	5016	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1880	2228	install-win64-11.5.8.exe	75
PID 2228 wrote to memory of 1880	2228	install-win64-11.5.8.exe	75
PID 2228 wrote to memory of 1880	2228	install-win64-11.5.8.exe	75
PID 1880 wrote to memory of 5016	1880	FORGET~2.EXE	82
PID 1880 wrote to memory of 5016	1880	FORGET~2.EXE	82
PID 1880 wrote to memory of 5016	1880	FORGET~2.EXE	82
PID 1880 wrote to memory of 3196	1880	FORGET~2.EXE	89
PID 1880 wrote to memory of 3196	1880	FORGET~2.EXE	89
PID 1880 wrote to memory of 3196	1880	FORGET~2.EXE	89
PID 1880 wrote to memory of 2888	1880	FORGET~2.EXE	90
PID 1880 wrote to memory of 2888	1880	FORGET~2.EXE	90
PID 1880 wrote to memory of 2888	1880	FORGET~2.EXE	90
PID 1880 wrote to memory of 2888	1880	FORGET~2.EXE	90
PID 1880 wrote to memory of 2888	1880	FORGET~2.EXE	90
PID 1880 wrote to memory of 2888	1880	FORGET~2.EXE	90
PID 1880 wrote to memory of 2888	1880	FORGET~2.EXE	90
PID 1880 wrote to memory of 2888	1880	FORGET~2.EXE	90
PID 1880 wrote to memory of 2888	1880	FORGET~2.EXE	90

C:\Users\Admin\AppData\Local\Temp\install-win64-11.5.8.exe
"C:\Users\Admin\AppData\Local\Temp\install-win64-11.5.8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORGET~2.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORGET~2.EXE
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORGET~2.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORGET~2.EXE
    3⤵
    - Executes dropped EXE
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORGET~2.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORGET~2.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FORGET~2.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORGET~2.EXE
Size 362.5MB
SHA256 19f8bba9fd799923ed45b1478083a22da57d03ad860995b6b2ea5259858a65b4
MD5 5d62afed04ebb5d2de1fd78c1c80335d
SHA1 f102401eaf54a46dc37713b6190ac27a2e682162
SHA512 a89b3136874fd28ac576aa7bd05b4220f70f005fbf5c5232344c36ead123f9fb03266097c56fe94101342a10fdfc8cb53e73851ce42a39a6552afa730e35c1bb
SSDEEP 1536:1WRDqbOkzV6DtmX3Q0wyzNOI/QEKSfjSPwxpbtedbXakn24Dl4z3AMvEftemVcl:SqFEtg3+yzTQIjzptedjn2OMvE1e8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

FORGET~2.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORGET~2.EXE
Size 362.5MB
SHA256 19f8bba9fd799923ed45b1478083a22da57d03ad860995b6b2ea5259858a65b4
MD5 5d62afed04ebb5d2de1fd78c1c80335d
SHA1 f102401eaf54a46dc37713b6190ac27a2e682162
SHA512 a89b3136874fd28ac576aa7bd05b4220f70f005fbf5c5232344c36ead123f9fb03266097c56fe94101342a10fdfc8cb53e73851ce42a39a6552afa730e35c1bb
SSDEEP 1536:1WRDqbOkzV6DtmX3Q0wyzNOI/QEKSfjSPwxpbtedbXakn24Dl4z3AMvEftemVcl:SqFEtg3+yzTQIjzptedjn2OMvE1e8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

FORGET~2.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORGET~2.EXE
Size 361.4MB
SHA256 d04fedfa8de25d073ff91f02bb0b4984b9ba15f8a7e17025012f957f704b4cf3
MD5 a53556941840ef026ab03585735e87b1
SHA1 06d5864b68d2cac60645a47e48446600f06c759d
SHA512 4f6b7e914030bb35dac3ba24d9a48f3f19e112b50fdab6800dba21338739427de068108ce0c4b442fe7b7a102d01e9dd0e196ef615b30854e6d81928c61bff53
SSDEEP 1536:1WRDqbOkzV6DtmX3Q0wyzNOI/QEKSfjSPwxpbtedbXakn24Dl4z3AMvEftemVcl:SqFEtg3+yzTQIjzptedjn2OMvE1e8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

FORGET~2.EXE

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FORGET~2.EXE
Size 333.0MB
SHA256 3ddac641b1e574894e6bef1c8af1ec3144ad12fbcd04113a5fe44c0d584ec62e
MD5 c2d68509d1cc0ab7926df6983f0117e0
SHA1 d653d71e9f46f278167af3745ba3ab59e4de8666
SHA512 445c6193f5d00cb1ed200ca15adf9db760e5fe1320e5dcf34912f5fd9a036f0aee4b58597d4edcb5705da78b2d1794f25b26337d4ea45551591ada1264ac972c
SSDEEP 1536:1WRDqbOkzV6DtmX3Q0wyzNOI/QEKSfjSPwxpbtedbXakn24Dl4z3AMvEftemVcl:SqFEtg3+yzTQIjzptedjn2OMvE1e8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1880-135-0x0000000000410000-0x000000000042E000-memory.dmp

Download

memory/1880-136-0x0000000006100000-0x00000000066A4000-memory.dmp

Download

memory/1880-137-0x0000000005C50000-0x0000000005CE2000-memory.dmp

Download

memory/1880-138-0x0000000005C00000-0x0000000005C22000-memory.dmp

Download

memory/2888-150-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2888-155-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2888-154-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2888-153-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2888-152-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5016-145-0x0000000007AB0000-0x000000000812A000-memory.dmp

Download

memory/5016-141-0x00000000052E0000-0x0000000005908000-memory.dmp

Download

memory/5016-140-0x0000000004C10000-0x0000000004C46000-memory.dmp

Download

memory/5016-146-0x0000000006750000-0x000000000676A000-memory.dmp

Download

memory/5016-143-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Download

memory/5016-144-0x0000000004F60000-0x0000000004F7E000-memory.dmp

Download

memory/5016-142-0x00000000059F0000-0x0000000005A56000-memory.dmp

Download