Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 00:50
Static task
static1
Behavioral task
behavioral1
Sample
f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exe
Resource
win7-20220901-en
General
-
Target
f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exe
-
Size
149KB
-
MD5
0fac315ec4746ef1c689913d24313442
-
SHA1
e194946ac76e6b72d727a51bcbd842184c88fb3d
-
SHA256
f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e
-
SHA512
b9b77964d138812df7605362f0d06d5bf202a56ed9661de6178afb4dea15e2b31e096807d6387ead174d8143202aa31b3d24c3c36087989542fed0973b0f4b52
-
SSDEEP
3072:pdHHCd42U7jKXznulGJ5gywZCHjWV/2IBh5wtOZ7Q:pxHN7juznxvgyiEjWVeIBh5IOW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
explorer.exemtvdemd.exehpwebregUI.exepid process 2256 explorer.exe 4704 mtvdemd.exe 1792 hpwebregUI.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explorer.exemtvdemd.exef875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation explorer.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation mtvdemd.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
mtvdemd.exeAppLaunch.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\© Microsoft Real Time Media Stack = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\mtvdemd.exe" mtvdemd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run AppLaunch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Media Player = "C:\\Windows\\system\\csrcs.exe" AppLaunch.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
explorer.exehpwebregUI.exedescription pid process target process PID 2256 set thread context of 2976 2256 explorer.exe AppLaunch.exe PID 1792 set thread context of 4228 1792 hpwebregUI.exe AppLaunch.exe -
Drops file in Windows directory 2 IoCs
Processes:
AppLaunch.exedescription ioc process File created C:\Windows\system\csrcs.exe AppLaunch.exe File opened for modification C:\Windows\system\csrcs.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
explorer.exemtvdemd.exehpwebregUI.exepid process 2256 explorer.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe 4704 mtvdemd.exe 2256 explorer.exe 1792 hpwebregUI.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exeexplorer.exemtvdemd.exehpwebregUI.exedescription pid process Token: SeDebugPrivilege 5056 f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exe Token: SeDebugPrivilege 2256 explorer.exe Token: SeDebugPrivilege 4704 mtvdemd.exe Token: SeDebugPrivilege 1792 hpwebregUI.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AppLaunch.exeAppLaunch.exepid process 2976 AppLaunch.exe 4228 AppLaunch.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exeexplorer.exemtvdemd.exehpwebregUI.exedescription pid process target process PID 5056 wrote to memory of 2256 5056 f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exe explorer.exe PID 5056 wrote to memory of 2256 5056 f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exe explorer.exe PID 5056 wrote to memory of 2256 5056 f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exe explorer.exe PID 2256 wrote to memory of 2976 2256 explorer.exe AppLaunch.exe PID 2256 wrote to memory of 2976 2256 explorer.exe AppLaunch.exe PID 2256 wrote to memory of 2976 2256 explorer.exe AppLaunch.exe PID 2256 wrote to memory of 2976 2256 explorer.exe AppLaunch.exe PID 2256 wrote to memory of 2976 2256 explorer.exe AppLaunch.exe PID 2256 wrote to memory of 2976 2256 explorer.exe AppLaunch.exe PID 2256 wrote to memory of 2976 2256 explorer.exe AppLaunch.exe PID 2256 wrote to memory of 2976 2256 explorer.exe AppLaunch.exe PID 2256 wrote to memory of 4704 2256 explorer.exe mtvdemd.exe PID 2256 wrote to memory of 4704 2256 explorer.exe mtvdemd.exe PID 2256 wrote to memory of 4704 2256 explorer.exe mtvdemd.exe PID 4704 wrote to memory of 1792 4704 mtvdemd.exe hpwebregUI.exe PID 4704 wrote to memory of 1792 4704 mtvdemd.exe hpwebregUI.exe PID 4704 wrote to memory of 1792 4704 mtvdemd.exe hpwebregUI.exe PID 1792 wrote to memory of 4228 1792 hpwebregUI.exe AppLaunch.exe PID 1792 wrote to memory of 4228 1792 hpwebregUI.exe AppLaunch.exe PID 1792 wrote to memory of 4228 1792 hpwebregUI.exe AppLaunch.exe PID 1792 wrote to memory of 4228 1792 hpwebregUI.exe AppLaunch.exe PID 1792 wrote to memory of 4228 1792 hpwebregUI.exe AppLaunch.exe PID 1792 wrote to memory of 4228 1792 hpwebregUI.exe AppLaunch.exe PID 1792 wrote to memory of 4228 1792 hpwebregUI.exe AppLaunch.exe PID 1792 wrote to memory of 4228 1792 hpwebregUI.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exe"C:\Users\Admin\AppData\Local\Temp\f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\System\mtvdemd.exe"C:\Users\Admin\AppData\Local\Temp\System\mtvdemd.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System\hpwebregUI.exe"C:\Users\Admin\AppData\Local\Temp\System\hpwebregUI.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe5⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
102B
MD5355393ee7ce338212c791d6f2a1ca0e3
SHA18a383112fc6d881ecfa2d0d5dfdcea437d55fd4b
SHA256a0e1021bf918b0eb199a6efa61179b7a7b4504a42b40e8606b8f10fae9c2913a
SHA512163a9159c13bad41b3781e28c828f803d7ed2a0a6ebe765483b5278b445ae2881b813fd9bf7c9f83be89f4faef6efbae84922208cf8baaca878df3dcc1af6ee5
-
C:\Users\Admin\AppData\Local\Temp\System\hpwebregUI.exeFilesize
149KB
MD50fac315ec4746ef1c689913d24313442
SHA1e194946ac76e6b72d727a51bcbd842184c88fb3d
SHA256f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e
SHA512b9b77964d138812df7605362f0d06d5bf202a56ed9661de6178afb4dea15e2b31e096807d6387ead174d8143202aa31b3d24c3c36087989542fed0973b0f4b52
-
C:\Users\Admin\AppData\Local\Temp\System\hpwebregUI.exeFilesize
149KB
MD50fac315ec4746ef1c689913d24313442
SHA1e194946ac76e6b72d727a51bcbd842184c88fb3d
SHA256f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e
SHA512b9b77964d138812df7605362f0d06d5bf202a56ed9661de6178afb4dea15e2b31e096807d6387ead174d8143202aa31b3d24c3c36087989542fed0973b0f4b52
-
C:\Users\Admin\AppData\Local\Temp\System\mtvdemd.exeFilesize
52KB
MD56b7c453e06409a09412d053a7bfc2bfc
SHA1e85e053dfacfa64a9a9a64c517fd7bc2915c73c5
SHA256fc40dc24916ebaa3c675182e3d9d8a0febc6c76ec064b94851ca48400a3f5fd0
SHA512e782be26f9588b2eb1bae679631e989730b444406cbe47df4d9572e7dc56b10eb1b9b53cdd002d33523e63ac9da9019935c690773b5c682b090a57f824969644
-
C:\Users\Admin\AppData\Local\Temp\System\mtvdemd.exeFilesize
52KB
MD56b7c453e06409a09412d053a7bfc2bfc
SHA1e85e053dfacfa64a9a9a64c517fd7bc2915c73c5
SHA256fc40dc24916ebaa3c675182e3d9d8a0febc6c76ec064b94851ca48400a3f5fd0
SHA512e782be26f9588b2eb1bae679631e989730b444406cbe47df4d9572e7dc56b10eb1b9b53cdd002d33523e63ac9da9019935c690773b5c682b090a57f824969644
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exeFilesize
149KB
MD50fac315ec4746ef1c689913d24313442
SHA1e194946ac76e6b72d727a51bcbd842184c88fb3d
SHA256f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e
SHA512b9b77964d138812df7605362f0d06d5bf202a56ed9661de6178afb4dea15e2b31e096807d6387ead174d8143202aa31b3d24c3c36087989542fed0973b0f4b52
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exeFilesize
149KB
MD50fac315ec4746ef1c689913d24313442
SHA1e194946ac76e6b72d727a51bcbd842184c88fb3d
SHA256f875336962e8a166ed871858b6f624961ff9b7f1317d5c6ad55bb2782c4c327e
SHA512b9b77964d138812df7605362f0d06d5bf202a56ed9661de6178afb4dea15e2b31e096807d6387ead174d8143202aa31b3d24c3c36087989542fed0973b0f4b52
-
memory/1792-161-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/1792-150-0x0000000000000000-mapping.dmp
-
memory/1792-158-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/2256-159-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/2256-139-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/2256-133-0x0000000000000000-mapping.dmp
-
memory/2976-138-0x0000000000000000-mapping.dmp
-
memory/2976-142-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2976-140-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/4228-152-0x0000000000000000-mapping.dmp
-
memory/4704-145-0x0000000000000000-mapping.dmp
-
memory/4704-148-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/4704-160-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/5056-132-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/5056-136-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB