4af82e2942c843c88fd4dc43cfe11b9fc286c7ea1dac32bf4ee9de439eed07fd

Analysis

max time kernel
109s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2022, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d96604e0d1ab34d42d267783ade26fa.exe
Size 6.5MB
Sample221223-e5d9yaba4w
SHA256 4af82e2942c843c88fd4dc43cfe11b9fc286c7ea1dac32bf4ee9de439eed07fd
MD5 5d96604e0d1ab34d42d267783ade26fa
SHA1 5690c2fd39290c52656099dbaa6ab71645ef7fcf
SHA512 35e537e1a1ac8cfc5f8d042b5c26167fc7ffde7e27f349f6df23878cace3a550402c51ca3b0a0ea62ca0f284dba00a91f08cb25d11aea49dc5326a5331b47cf4
SSDEEP 196608:LzvolaY8aa303pN4r6IYxSb60nUWTX6m:/4aXaasE6IYYQU6m
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	svcupdater.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5d96604e0d1ab34d42d267783ade26fa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4972	5d96604e0d1ab34d42d267783ade26fa.exe
4972	5d96604e0d1ab34d42d267783ade26fa.exe
2844	svcupdater.exe
2844	svcupdater.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3260	4972	5d96604e0d1ab34d42d267783ade26fa.exe	81
PID 4972 wrote to memory of 3260	4972	5d96604e0d1ab34d42d267783ade26fa.exe	81
PID 4972 wrote to memory of 3260	4972	5d96604e0d1ab34d42d267783ade26fa.exe	81

C:\Users\Admin\AppData\Local\Temp\5d96604e0d1ab34d42d267783ade26fa.exe
"C:\Users\Admin\AppData\Local\Temp\5d96604e0d1ab34d42d267783ade26fa.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Creates scheduled task(s)
  PID:3260

C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
Size 294.9MB
SHA256 823760c9729efbd5427a31c03400fffa0e7995d5395d0d15a1dc704eb6ea6e1a
MD5 eebd83ff3483a86bdbd9bbcb04e54aff
SHA1 ffb0d1b327b9e6c8de5a892131140ec8f701d9fa
SHA512 e23ca4fa6b8f1b51c009436eb8ff0d39267cd839ab2e2d899c46c867c3216b84e583cfb6b40ac447685e566203787f4857a51c870bb6780fa4cdf8da540dd3c8
SSDEEP 6291456:0RHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHh:0RHHHHHHHHHHHHHHHHHHHHHHHHHHHHHh
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
Size 468.2MB
SHA256 b22e723612cc65d968d301ae050a4e3ddfd47829cf6d227b8068d987ab6213b7
MD5 29aa1fb768e5aa7276d9b6c3d72c176a
SHA1 5234f9aa9b1d159aaed4599848ea1c60dbfc1227
SHA512 3f3149916569e11b534e8b879cd463db1f7d5bc6edcf3d7dcb5495854637cbe2a83cbaf485e8cf1129bc7326e18dd85b5af8679d97ff77fea06ea1a8cb6f3890
SSDEEP 12582912:0RHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHI:d
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2844-140-0x00000000007E0000-0x00000000011F9000-memory.dmp

Download

memory/2844-142-0x00000000007E0000-0x00000000011F9000-memory.dmp

Download

memory/4972-132-0x0000000000420000-0x0000000000E39000-memory.dmp

Download

memory/4972-134-0x0000000000420000-0x0000000000E39000-memory.dmp

Download

memory/4972-135-0x0000000000420000-0x0000000000E39000-memory.dmp

Download

memory/4972-137-0x0000000000420000-0x0000000000E39000-memory.dmp

Download