b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d

Analysis

max time kernel
142s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2022, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d.exe
Size

4.8MB
MD5

05dfb9f09be3fbc1b4cf81602385b0e3
SHA1

2e12eb46bc24ee10ebf164c5ae7f490a4a5be09d
SHA256

b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d
SHA512

e7d87739f300d9b90cf723dcc0aed8053179fda0cb4a1850dcda33fe0e604c96239ab7847989dbb320096d900a52eefe5ea45f34a63de2681f25b1c43f632c97
SSDEEP

98304:8JdWr3JapUG0/vUpptbPq9DzqX8etADYAAzgSQBFnciKPqzH6/omDhz:8JdWrUrpptUDW48ArhFcdeiokp

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2584	FSCapture.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2732-132-0x0000000000400000-0x00000000004DD000-memory.dmp	upx
behavioral2/memory/2732-138-0x0000000000400000-0x00000000004DD000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: 33	2584	FSCapture.exe
Token: SeIncBasePriorityPrivilege	2584	FSCapture.exe
Token: 33	2584	FSCapture.exe
Token: SeIncBasePriorityPrivilege	2584	FSCapture.exe
Token: 33	2584	FSCapture.exe
Token: SeIncBasePriorityPrivilege	2584	FSCapture.exe
Token: 33	2584	FSCapture.exe
Token: SeIncBasePriorityPrivilege	2584	FSCapture.exe
Token: 33	2584	FSCapture.exe
Token: SeIncBasePriorityPrivilege	2584	FSCapture.exe
Token: 33	2584	FSCapture.exe
Token: SeIncBasePriorityPrivilege	2584	FSCapture.exe
Token: 33	2584	FSCapture.exe
Token: SeIncBasePriorityPrivilege	2584	FSCapture.exe
Token: 33	2584	FSCapture.exe
Token: SeIncBasePriorityPrivilege	2584	FSCapture.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2584	FSCapture.exe
2584	FSCapture.exe
2584	FSCapture.exe
2584	FSCapture.exe
2584	FSCapture.exe
2584	FSCapture.exe
2584	FSCapture.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2584	FSCapture.exe
2584	FSCapture.exe
2584	FSCapture.exe
2584	FSCapture.exe
2584	FSCapture.exe
2584	FSCapture.exe
2584	FSCapture.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2584	FSCapture.exe
2584	FSCapture.exe
2584	FSCapture.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2584	2732	b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d.exe	85
PID 2732 wrote to memory of 2584	2732	b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d.exe	85
PID 2732 wrote to memory of 2584	2732	b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d.exe	85

C:\Users\Admin\AppData\Local\Temp\b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d.exe
"C:\Users\Admin\AppData\Local\Temp\b072a4786fe7636faaf03ebfb8c99daeda0cced728916efec70cced2591e260d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\FSCapture.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\FSCapture.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\FSCapture.exe

Filesize
6.8MB

MD5
85c9962e5f9cb1c24d8e93dcbd113c2f

SHA1
89703212386cc4a90831ca42b2a1a446b4ce575b

SHA256
a21e2f4d98ca8247b9a4c1400553febb37e3607e050c0e1195efd78e934d65d4

SHA512
314543a5fda837925c0589d803fad5279722f19cbda9307e69cd5dee1e0bdb4e9745f4b33f19e585a47006999c4a220d4976f3afad9042796a2df7267e11dfa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\FSCapture.exe

Filesize
6.8MB

MD5
85c9962e5f9cb1c24d8e93dcbd113c2f

SHA1
89703212386cc4a90831ca42b2a1a446b4ce575b

SHA256
a21e2f4d98ca8247b9a4c1400553febb37e3607e050c0e1195efd78e934d65d4

SHA512
314543a5fda837925c0589d803fad5279722f19cbda9307e69cd5dee1e0bdb4e9745f4b33f19e585a47006999c4a220d4976f3afad9042796a2df7267e11dfa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\Languages\FSC02.fslang

Filesize
178KB

MD5
92e8a6d15e98db5d0a699053fecce518

SHA1
8c7e9c7c227df28655941010b0f1d752176eefae

SHA256
7d60c2b39d14eac73798dc72f6949fe0f656918949513b1c7a9b049a6bff053c

SHA512
cab6b874d6f826dc29bc66656a6c17f6c5362810303495bcb342046a8face2e2afd739abfa574ae9626eddadb5fa13b5a1e7cee49b3065aa1340a522e02ea1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FSCapture\fsc.db

Filesize
7KB

MD5
e9c904e95c50fb2f75770dec154c546e

SHA1
41106529ffb09dc4e752589c11ddb8f92864a195

SHA256
daea7457aa9af307179f8337ebd286a59ece673819cb137576a68792b1b594f0

SHA512
8e497ffbcbbd32c6f544bb393145cdb96af51ae4f457ed27f9151e1b814c8b4f2e94c75d8ccdfa9b6902fbe93429466f0cefc184b733c45f6462c1f200a22ae9

Download Submit
memory/2732-132-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2732-138-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download