Analysis
- max time kernel
131s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
25/12/2022, 11:48
General
- Target 4a75f7dda9143bb7d91023698154c3b6.exe
- Size 6.4MB
- Sample221225-nyfc4abe22
- SHA256 c78d7e44e0997c3dc22b3a81ce8964e4069ce2dceb020dbfacad153d2e9a4e82
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a75f7dda9143bb7d91023698154c3b6.exe"C:\Users\Admin\AppData\Local\Temp\4a75f7dda9143bb7d91023698154c3b6.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exeC:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
svcupdater.exe
svcupdater.exe
memory/3544-139-0x0000000000690000-0x000000000109E000-memory.dmp
memory/3544-141-0x0000000000690000-0x000000000109E000-memory.dmp
memory/4988-132-0x0000000000650000-0x000000000105E000-memory.dmp
memory/4988-134-0x0000000000650000-0x000000000105E000-memory.dmp
memory/4988-136-0x0000000000650000-0x000000000105E000-memory.dmp