ecee05b4c31d59f8048497d202808d034d54846efd9cbd447d83f1fd4f3f2c49

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/01/2023, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 287KB
Sample230121-twcr3sda87
SHA256 ecee05b4c31d59f8048497d202808d034d54846efd9cbd447d83f1fd4f3f2c49
MD5 507840e833a51fd710d92ee3aac0eed5
SHA1 71d4a810409f91f31bd990fc4ec56697f0a869ba
SHA512 265324e2b604d3493fcb66b2dc19d9d0cec81ab59b0b69f4b8c9fb3a2c23d5cac97c1f3d956be91f1e135b01b1f82fc9db2d8696d96afa2fdd31b28afb3a7f09
SSDEEP 6144:9mGRLg4EHVV1cWCCkkSnVg2n1bjN+AhQC3nliTXy:EsnEHVn9ElVL1bjN+AbsTXy
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4720	svcupdater.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3496	1060	WerFault.exe	81

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2952	schtasks.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2952	1060	file.exe	86
PID 1060 wrote to memory of 2952	1060	file.exe	86
PID 1060 wrote to memory of 2952	1060	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Creates scheduled task(s)
  PID:2952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 696
  2⤵
  - Program crash
  PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1060 -ip 1060
1⤵
PID:4856

C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
1⤵
- Executes dropped EXE
PID:4720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
Size 829.6MB
SHA256 1f17126783037f2d754c7293732be4d4eb3b1fc3e4e948b8cd607206584858a8
MD5 c45fd5c8ec38a6a5944149a9be0a4056
SHA1 4e9309c30136f04340c6e389de6987b260884867
SHA512 71aaf9304171e0e6108fc3c46789bf12a164192ac2d46106b83a0077cf58b09a05591c5da2e7f3e07943a4187f8ff800754cea63a35e6cfaefe517496cec8c74
SSDEEP 786432:UnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnX:a
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
Size 789.1MB
SHA256 8ec281d0d5f1d92c0f8cb01cc1e74e2b3ed1c56c205c32baaeab004b30a7fd25
MD5 dbc44d823f8c88c71542f1457e65c992
SHA1 09ab20eb0927d77f0e167de99c0daba9345cfabe
SHA512 d5d9ae8285e287c9d784eea8f4c9be31c51b2977239036d90c2f8c48a03b670561d4633f549d678de2048bc1ad69bcb70c13a59d77d977410123798b034e2dcf
SSDEEP 786432:UnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnR:M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1060-132-0x0000000002E50000-0x0000000002E7A000-memory.dmp

Download

memory/1060-133-0x00000000048F0000-0x0000000004937000-memory.dmp

Download

memory/1060-134-0x0000000000400000-0x0000000002BB2000-memory.dmp

Download

memory/1060-136-0x0000000000400000-0x0000000002BB2000-memory.dmp

Download

memory/4720-139-0x0000000002E3E000-0x0000000002E68000-memory.dmp

Download

memory/4720-140-0x0000000000400000-0x0000000002BB2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads