Analysis
- max time kernel
143s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
04/01/2023, 12:49
General
- Target 9be5945bc685f80ca57eec73698cc671.exe
- Size 581KB
- Sample230104-p2cl2sah7x
- SHA256 cbc02e3b31331d244cfda0950d3b97b9eaff9244dcbd691ce40ea08dec7375ea
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9be5945bc685f80ca57eec73698cc671.exe"C:\Users\Admin\AppData\Local\Temp\9be5945bc685f80ca57eec73698cc671.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 3; Set-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\9be5945bc685f80ca57eec73698cc671.exeC:\Users\Admin\AppData\Roaming\9be5945bc685f80ca57eec73698cc671.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
9be5945bc685f80ca57eec73698cc671.exe.log
9be5945bc685f80ca57eec73698cc671.exe
9be5945bc685f80ca57eec73698cc671.exe
memory/312-141-0x00007FFF7B920000-0x00007FFF7C3E1000-memory.dmp
memory/312-144-0x00007FFF7B920000-0x00007FFF7C3E1000-memory.dmp
memory/1508-136-0x000001BBEE4D0000-0x000001BBEE4F2000-memory.dmp
memory/1508-142-0x00007FFF7B920000-0x00007FFF7C3E1000-memory.dmp
memory/1508-143-0x00007FFF7B920000-0x00007FFF7C3E1000-memory.dmp
memory/5056-134-0x00007FFF7B920000-0x00007FFF7C3E1000-memory.dmp
memory/5056-133-0x00007FFF7B920000-0x00007FFF7C3E1000-memory.dmp
memory/5056-140-0x00007FFF7B920000-0x00007FFF7C3E1000-memory.dmp
memory/5056-132-0x00000000008F0000-0x0000000000986000-memory.dmp