Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 21:28
Static task
static1
Behavioral task
behavioral1
Sample
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe
Resource
win7-20220901-en
General
-
Target
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe
-
Size
196KB
-
MD5
4bb78b357355de65331534be4f1c53d3
-
SHA1
a318fdbff560c4afb1ed85686578a12fd85227e0
-
SHA256
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4
-
SHA512
95135d7b7dd4a0cb6db08bc269c030ece5a86d333741b2bc9c1fb9b52957411019d8b3bd54fc670d9668cf4a4147109cd2c74f49425dd21ebecb3b98e69cb2f4
-
SSDEEP
3072:vLBy3wJIadagPv77DFjbp1UG+SKGLxy9RZLhOkaOyVa3b+cmDjbd5/V/XMu:1yAJ15373Fjbp+SXxwOkPMsbz6j7Fcu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
.M.exepid process 3500 .M.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1216 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exepid process 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe.M.exedescription pid process Token: SeDebugPrivilege 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe Token: SeDebugPrivilege 3500 .M.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.execmd.execmd.exedescription pid process target process PID 4648 wrote to memory of 3504 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 4648 wrote to memory of 3504 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 4648 wrote to memory of 3504 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 4648 wrote to memory of 2472 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 4648 wrote to memory of 2472 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 4648 wrote to memory of 2472 4648 75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe cmd.exe PID 3504 wrote to memory of 3592 3504 cmd.exe schtasks.exe PID 3504 wrote to memory of 3592 3504 cmd.exe schtasks.exe PID 3504 wrote to memory of 3592 3504 cmd.exe schtasks.exe PID 2472 wrote to memory of 1216 2472 cmd.exe timeout.exe PID 2472 wrote to memory of 1216 2472 cmd.exe timeout.exe PID 2472 wrote to memory of 1216 2472 cmd.exe timeout.exe PID 2472 wrote to memory of 3500 2472 cmd.exe .M.exe PID 2472 wrote to memory of 3500 2472 cmd.exe .M.exe PID 2472 wrote to memory of 3500 2472 cmd.exe .M.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe"C:\Users\Admin\AppData\Local\Temp\75c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn ".M" /tr '"C:\Users\Admin\AppData\Roaming\.M.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn ".M" /tr '"C:\Users\Admin\AppData\Roaming\.M.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8438.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\.M.exe"C:\Users\Admin\AppData\Roaming\.M.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8438.tmp.batFilesize
146B
MD54ad9e7ac0ea655e64f6704ddb0f0c08a
SHA12efa3b41e617ed73091c9db7f95a7615eae0e447
SHA2565cc6a2bb35c4a7fadccf0a4dfbc16960c50685942afeead700dfd00dd4709b58
SHA5124e7591c372ef03fee0b3d3b3fa2fa07232ac16d927026448f4d15bb5f54017ef4e4826bd61c9ebab78395255835bd69eb528a182a1759745ce807cc867462d63
-
C:\Users\Admin\AppData\Roaming\.M.exeFilesize
196KB
MD54bb78b357355de65331534be4f1c53d3
SHA1a318fdbff560c4afb1ed85686578a12fd85227e0
SHA25675c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4
SHA51295135d7b7dd4a0cb6db08bc269c030ece5a86d333741b2bc9c1fb9b52957411019d8b3bd54fc670d9668cf4a4147109cd2c74f49425dd21ebecb3b98e69cb2f4
-
C:\Users\Admin\AppData\Roaming\.M.exeFilesize
196KB
MD54bb78b357355de65331534be4f1c53d3
SHA1a318fdbff560c4afb1ed85686578a12fd85227e0
SHA25675c8700bde8f6d468164fbcc3bee7f877330dbce27713e6b4d2969524bc2e4a4
SHA51295135d7b7dd4a0cb6db08bc269c030ece5a86d333741b2bc9c1fb9b52957411019d8b3bd54fc670d9668cf4a4147109cd2c74f49425dd21ebecb3b98e69cb2f4
-
memory/1216-138-0x0000000000000000-mapping.dmp
-
memory/2472-135-0x0000000000000000-mapping.dmp
-
memory/3500-139-0x0000000000000000-mapping.dmp
-
memory/3504-134-0x0000000000000000-mapping.dmp
-
memory/3592-137-0x0000000000000000-mapping.dmp
-
memory/4648-132-0x0000000000C40000-0x0000000000C48000-memory.dmpFilesize
32KB
-
memory/4648-133-0x00000000055E0000-0x000000000567C000-memory.dmpFilesize
624KB