Overview

overview

8

Static

static

Roominglists.exe

windows7-x64

8

Roominglists.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2023, 06:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Roominglists.exe
  • Size 269KB
  • Sample230120-grflyshf7z
  • SHA256 b6fe7602e8f288c48cf04e60306dc9349c5b9ebeb8faf35905abede7d0525480
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Users\Admin\AppData\Local\Temp\Roominglists.exe
      "C:\Users\Admin\AppData\Local\Temp\Roominglists.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Users\Admin\AppData\Local\Temp\sknwdtcan.exe
        "C:\Users\Admin\AppData\Local\Temp\sknwdtcan.exe" C:\Users\Admin\AppData\Local\Temp\gbnrxsaxqj.qqz
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2388
        • C:\Users\Admin\AppData\Local\Temp\sknwdtcan.exe
          "C:\Users\Admin\AppData\Local\Temp\sknwdtcan.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:5080
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\SysWOW64\mstsc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:364
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 364 -s 184
            4⤵
            • Program crash
            PID:2420
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 440 -p 364 -ip 364
      1⤵
        PID:1864

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            gbnrxsaxqj.qqz
            • Path C:\Users\Admin\AppData\Local\Temp\gbnrxsaxqj.qqz
            • Size 5KB
            • SHA256 7b55e939f7447719326c8445f7c514ef2b47c451bcebe17edb2e527765893573
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            qyidtqwjhp.znq
            • Path C:\Users\Admin\AppData\Local\Temp\qyidtqwjhp.znq
            • Size 205KB
            • SHA256 ada83789cdf6996bb34d6d892097d8311f513f91eeed56c0ef3eba7956b9c8dd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sknwdtcan.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sknwdtcan.exe
            • Size 46KB
            • SHA256 50a29e6511ef68179f9a68dd2a5f63aab82805999509b5e4d81aa96136b51e57
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sknwdtcan.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sknwdtcan.exe
            • Size 46KB
            • SHA256 50a29e6511ef68179f9a68dd2a5f63aab82805999509b5e4d81aa96136b51e57
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sknwdtcan.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sknwdtcan.exe
            • Size 46KB
            • SHA256 50a29e6511ef68179f9a68dd2a5f63aab82805999509b5e4d81aa96136b51e57
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1508-146-0x0000000000DC0000-0x0000000000DED000-memory.dmp
            Download

            memory/1508-148-0x0000000002D80000-0x0000000002E0F000-memory.dmp
            Download

            memory/1508-147-0x0000000002F20000-0x000000000326A000-memory.dmp
            Download

            memory/1508-145-0x00000000008C0000-0x00000000009FA000-memory.dmp
            Download

            memory/2804-150-0x0000000008200000-0x00000000082EF000-memory.dmp
            Download

            memory/2804-149-0x0000000008200000-0x00000000082EF000-memory.dmp
            Download

            memory/2804-142-0x0000000002BD0000-0x0000000002C89000-memory.dmp
            Download

            memory/5080-140-0x0000000000B50000-0x0000000000E9A000-memory.dmp
            Download

            memory/5080-144-0x0000000000400000-0x000000000042F000-memory.dmp
            Download

            memory/5080-141-0x00000000006A0000-0x00000000006B0000-memory.dmp
            Download

            memory/5080-139-0x0000000000400000-0x000000000042F000-memory.dmp
            Download