Overview

overview

8

Static

static

6bd25c680c...70.exe

windows7-x64

8

6bd25c680c...70.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2023, 15:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6bd25c680c1d1b4244d3a8a0905a2870.exe
  • Size 434KB
  • Sample230119-svrn6sdd2s
  • SHA256 a869d4bf9cb854007d1a00ddbcafde3d0aa1aab116dcbb871a59c5069a99ade7
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:684
    • C:\Users\Admin\AppData\Local\Temp\6bd25c680c1d1b4244d3a8a0905a2870.exe
      "C:\Users\Admin\AppData\Local\Temp\6bd25c680c1d1b4244d3a8a0905a2870.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Users\Admin\AppData\Local\Temp\sapdlyweqd.exe
        "C:\Users\Admin\AppData\Local\Temp\sapdlyweqd.exe" C:\Users\Admin\AppData\Local\Temp\wqeigjy.hhj
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3760
        • C:\Users\Admin\AppData\Local\Temp\sapdlyweqd.exe
          "C:\Users\Admin\AppData\Local\Temp\sapdlyweqd.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2976
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:3208
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3208 -s 184
            4⤵
            • Program crash
            PID:1288
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 456 -p 3208 -ip 3208
      1⤵
        PID:1088

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            mrwzc.q
            • Path C:\Users\Admin\AppData\Local\Temp\mrwzc.q
            • Size 205KB
            • SHA256 313fae1ca5901f77cfc3e31ece48c468705fdfc97a9f30ec36d639a46940b7bc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sapdlyweqd.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sapdlyweqd.exe
            • Size 46KB
            • SHA256 c95de4579eedcbe993893af85fda9dd3b3cf534157f3f3d7dfbaa847d5983fae
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sapdlyweqd.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sapdlyweqd.exe
            • Size 46KB
            • SHA256 c95de4579eedcbe993893af85fda9dd3b3cf534157f3f3d7dfbaa847d5983fae
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sapdlyweqd.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sapdlyweqd.exe
            • Size 46KB
            • SHA256 c95de4579eedcbe993893af85fda9dd3b3cf534157f3f3d7dfbaa847d5983fae
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wqeigjy.hhj
            • Path C:\Users\Admin\AppData\Local\Temp\wqeigjy.hhj
            • Size 5KB
            • SHA256 feab6c1895cf39a36fb76009ae8ff15ef67e976b683c4f14b5f01698a5bb7de2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/684-150-0x0000000008320000-0x00000000083DF000-memory.dmp
            Download

            memory/684-149-0x0000000008320000-0x00000000083DF000-memory.dmp
            Download

            memory/684-142-0x00000000081F0000-0x0000000008313000-memory.dmp
            Download

            memory/2132-145-0x0000000000990000-0x0000000000DC3000-memory.dmp
            Download

            memory/2132-148-0x0000000002D30000-0x0000000002DBF000-memory.dmp
            Download

            memory/2132-147-0x0000000002F00000-0x000000000324A000-memory.dmp
            Download

            memory/2132-146-0x00000000008C0000-0x00000000008ED000-memory.dmp
            Download

            memory/2976-140-0x00000000009A0000-0x0000000000CEA000-memory.dmp
            Download

            memory/2976-144-0x0000000000400000-0x000000000042F000-memory.dmp
            Download

            memory/2976-141-0x0000000000880000-0x0000000000890000-memory.dmp
            Download

            memory/2976-139-0x0000000000400000-0x000000000042F000-memory.dmp
            Download