Analysis
- max time kernel
91s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
14/12/2022, 13:30
General
- Target SecuriteInfo.com.Win32.PWSX-gen.29797.5874.exe
- Size 1008KB
- Sample221214-qrtcgsch3x
- SHA256 64e04b8bc093e2dbc49cd2ed382369a4ec0c78de9054cb8f747137c578a941e3
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29797.5874.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29797.5874.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zCRVDJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zCRVDJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1925.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29797.5874.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29797.5874.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29797.5874.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29797.5874.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29797.5874.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29797.5874.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp1925.tmp
memory/956-133-0x00000000056F0000-0x0000000005C94000-memory.dmp
memory/956-134-0x0000000005140000-0x00000000051D2000-memory.dmp
memory/956-135-0x00000000050B0000-0x00000000050BA000-memory.dmp
memory/956-136-0x0000000008D90000-0x0000000008E2C000-memory.dmp
memory/956-132-0x0000000000620000-0x0000000000722000-memory.dmp
memory/3188-147-0x0000000004F20000-0x0000000004F42000-memory.dmp
memory/3188-157-0x0000000007730000-0x0000000007DAA000-memory.dmp
memory/3188-139-0x00000000024C0000-0x00000000024F6000-memory.dmp
memory/3188-163-0x0000000007410000-0x0000000007418000-memory.dmp
memory/3188-162-0x0000000007430000-0x000000000744A000-memory.dmp
memory/3188-161-0x0000000007320000-0x000000000732E000-memory.dmp
memory/3188-148-0x0000000004FC0000-0x0000000005026000-memory.dmp
memory/3188-149-0x0000000005160000-0x00000000051C6000-memory.dmp
memory/3188-160-0x0000000007370000-0x0000000007406000-memory.dmp
memory/3188-159-0x0000000007160000-0x000000000716A000-memory.dmp
memory/3188-158-0x00000000070F0000-0x000000000710A000-memory.dmp
memory/3188-153-0x0000000005DF0000-0x0000000005E0E000-memory.dmp
memory/3188-154-0x0000000006DA0000-0x0000000006DD2000-memory.dmp
memory/3188-155-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/3188-156-0x00000000063A0000-0x00000000063BE000-memory.dmp
memory/3188-142-0x0000000005230000-0x0000000005858000-memory.dmp
memory/4672-152-0x00000000010A0000-0x00000000013EA000-memory.dmp
memory/4672-151-0x0000000000401000-0x000000000042E000-memory.dmp
memory/4672-150-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4672-145-0x0000000000400000-0x000000000042E000-memory.dmp