92517d9eb76bab41956c0dddf8160db00210e20b07f1b76a573c193fe5d40bb2

Analysis

max time kernel
301s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2023, 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ACH_ deposit _receipt12901234.exe
Size

817KB
MD5

fd42e94e57c66c93fc0a93e514101070
SHA1

3640481f0566252477aff1a98ec7ae9bb6051fed
SHA256

92517d9eb76bab41956c0dddf8160db00210e20b07f1b76a573c193fe5d40bb2
SHA512

f3a577ce8e2f715eebbe7cd69b015dee2d0129be83d4de742231adc226837a0ea7f95ffc989363146cddcafb435a9db24af864f1aca2fa6e35fa6c6eb7cc8d3a
SSDEEP

12288:J2zAi64ekCyyIS1UKeO9fUu3fopFwOZYjJ9rup5no5m/NrGIk7/3SzkZalfyl15O:JyipOZ4JxASz68m0U

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	ACH_ deposit _receipt12901234.exe

Executes dropped EXE 1 IoCs

pid	Process
4240	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	ACH_ deposit _receipt12901234.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4240 set thread context of 4988	4240	svchost.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
100	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
324	timeout.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
1212	ACH_ deposit _receipt12901234.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe
4240	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	ACH_ deposit _receipt12901234.exe
Token: SeDebugPrivilege	4240	svchost.exe
Token: SeDebugPrivilege	4988	jsc.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1884	1212	ACH_ deposit _receipt12901234.exe	86
PID 1212 wrote to memory of 1884	1212	ACH_ deposit _receipt12901234.exe	86
PID 1212 wrote to memory of 1300	1212	ACH_ deposit _receipt12901234.exe	88
PID 1212 wrote to memory of 1300	1212	ACH_ deposit _receipt12901234.exe	88
PID 1300 wrote to memory of 324	1300	cmd.exe	91
PID 1300 wrote to memory of 324	1300	cmd.exe	91
PID 1884 wrote to memory of 100	1884	cmd.exe	90
PID 1884 wrote to memory of 100	1884	cmd.exe	90
PID 1300 wrote to memory of 4240	1300	cmd.exe	92
PID 1300 wrote to memory of 4240	1300	cmd.exe	92
PID 4240 wrote to memory of 4024	4240	svchost.exe	93
PID 4240 wrote to memory of 4024	4240	svchost.exe	93
PID 4240 wrote to memory of 2660	4240	svchost.exe	94
PID 4240 wrote to memory of 2660	4240	svchost.exe	94
PID 4240 wrote to memory of 2596	4240	svchost.exe	95
PID 4240 wrote to memory of 2596	4240	svchost.exe	95
PID 4240 wrote to memory of 1468	4240	svchost.exe	97
PID 4240 wrote to memory of 1468	4240	svchost.exe	97
PID 4240 wrote to memory of 4436	4240	svchost.exe	96
PID 4240 wrote to memory of 4436	4240	svchost.exe	96
PID 4240 wrote to memory of 1836	4240	svchost.exe	98
PID 4240 wrote to memory of 1836	4240	svchost.exe	98
PID 4240 wrote to memory of 2156	4240	svchost.exe	99
PID 4240 wrote to memory of 2156	4240	svchost.exe	99
PID 4240 wrote to memory of 4188	4240	svchost.exe	100
PID 4240 wrote to memory of 4188	4240	svchost.exe	100
PID 4240 wrote to memory of 800	4240	svchost.exe	101
PID 4240 wrote to memory of 800	4240	svchost.exe	101
PID 4240 wrote to memory of 540	4240	svchost.exe	102
PID 4240 wrote to memory of 540	4240	svchost.exe	102
PID 4240 wrote to memory of 4204	4240	svchost.exe	103
PID 4240 wrote to memory of 4204	4240	svchost.exe	103
PID 4240 wrote to memory of 624	4240	svchost.exe	105
PID 4240 wrote to memory of 624	4240	svchost.exe	105
PID 4240 wrote to memory of 452	4240	svchost.exe	104
PID 4240 wrote to memory of 452	4240	svchost.exe	104
PID 4240 wrote to memory of 1364	4240	svchost.exe	106
PID 4240 wrote to memory of 1364	4240	svchost.exe	106
PID 4240 wrote to memory of 448	4240	svchost.exe	107
PID 4240 wrote to memory of 448	4240	svchost.exe	107
PID 4240 wrote to memory of 4988	4240	svchost.exe	108
PID 4240 wrote to memory of 4988	4240	svchost.exe	108
PID 4240 wrote to memory of 4988	4240	svchost.exe	108
PID 4240 wrote to memory of 4988	4240	svchost.exe	108
PID 4240 wrote to memory of 4988	4240	svchost.exe	108
PID 4240 wrote to memory of 4988	4240	svchost.exe	108
PID 4240 wrote to memory of 4988	4240	svchost.exe	108
PID 4240 wrote to memory of 4988	4240	svchost.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ACH_ deposit _receipt12901234.exe
"C:\Users\Admin\AppData\Local\Temp\ACH_ deposit _receipt12901234.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp84B5.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:324
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:4024
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
      4⤵
      PID:2660
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
      4⤵
      PID:2596
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
      4⤵
      PID:4436
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
      4⤵
      PID:1468
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1836
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
      4⤵
      PID:2156
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
      4⤵
      PID:4188
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
      4⤵
      PID:800
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
      4⤵
      PID:540
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
      4⤵
      PID:4204
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
      4⤵
      PID:452
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:624
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
      4⤵
      PID:1364
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
      4⤵
      PID:448
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp84B5.tmp.bat

Filesize
151B

MD5
c36cfae213469afc6e6ef018be150659

SHA1
2831cd4418d928ea04aa52b677ec06070d6b7fd7

SHA256
d18ff73e066a347713488c40c38db34270e23f79b9d25542035467de4969df35

SHA512
9520d2f2d5261bf5cb3a997201add6abf36f050a1d997fa71ff376758b0cf85bbc65f0e6c429e757beb85ec565565958a82142c3f35b3f145be8754f96bfd6e4

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
817KB

MD5
fd42e94e57c66c93fc0a93e514101070

SHA1
3640481f0566252477aff1a98ec7ae9bb6051fed

SHA256
92517d9eb76bab41956c0dddf8160db00210e20b07f1b76a573c193fe5d40bb2

SHA512
f3a577ce8e2f715eebbe7cd69b015dee2d0129be83d4de742231adc226837a0ea7f95ffc989363146cddcafb435a9db24af864f1aca2fa6e35fa6c6eb7cc8d3a

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
817KB

MD5
fd42e94e57c66c93fc0a93e514101070

SHA1
3640481f0566252477aff1a98ec7ae9bb6051fed

SHA256
92517d9eb76bab41956c0dddf8160db00210e20b07f1b76a573c193fe5d40bb2

SHA512
f3a577ce8e2f715eebbe7cd69b015dee2d0129be83d4de742231adc226837a0ea7f95ffc989363146cddcafb435a9db24af864f1aca2fa6e35fa6c6eb7cc8d3a

Download Submit
memory/1212-133-0x000001E8F6F70000-0x000001E8F7040000-memory.dmp

Filesize
832KB

Download
memory/1212-134-0x000001E8F9620000-0x000001E8F9630000-memory.dmp

Filesize
64KB

Download
memory/4988-143-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4988-145-0x0000000005390000-0x000000000542C000-memory.dmp

Filesize
624KB

Download
memory/4988-146-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/4988-147-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Filesize
408KB

Download
memory/4988-148-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/4988-149-0x0000000006630000-0x00000000066C2000-memory.dmp

Filesize
584KB

Download
memory/4988-150-0x0000000006C80000-0x0000000007224000-memory.dmp

Filesize
5.6MB

Download