1bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2

Resubmissions

16/03/2023, 08:52

230316-ksvdaacc8y 7

Analysis

max time kernel
496s
max time network
498s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2023, 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CISCO MAR -2023.exe
Size

224KB
MD5

b6404da30cc21b244a101b0a23a14709
SHA1

2d5ebc54fe027cada7eea7de141349229186df72
SHA256

1bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2
SHA512

a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e
SSDEEP

3072:X3BPXZf7nECworDBqhElSksQ9na/tK88sWR:X3znqksQRa/8vxR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	CISCO MAR -2023.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe	CISCO MAR -2023.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe	CISCO MAR -2023.exe

Executes dropped EXE 1 IoCs

pid	Process
928	svchost..exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	3412	dw20.exe
Token: SeBackupPrivilege	3412	dw20.exe
Token: SeBackupPrivilege	3412	dw20.exe
Token: SeBackupPrivilege	3412	dw20.exe
Token: SeBackupPrivilege	3412	dw20.exe
Token: SeBackupPrivilege	1868	dw20.exe
Token: SeBackupPrivilege	1868	dw20.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 928	4608	CISCO MAR -2023.exe	86
PID 4608 wrote to memory of 928	4608	CISCO MAR -2023.exe	86
PID 4608 wrote to memory of 928	4608	CISCO MAR -2023.exe	86
PID 4608 wrote to memory of 3412	4608	CISCO MAR -2023.exe	87
PID 4608 wrote to memory of 3412	4608	CISCO MAR -2023.exe	87
PID 4608 wrote to memory of 3412	4608	CISCO MAR -2023.exe	87
PID 928 wrote to memory of 1868	928	svchost..exe	88
PID 928 wrote to memory of 1868	928	svchost..exe	88
PID 928 wrote to memory of 1868	928	svchost..exe	88

C:\Users\Admin\AppData\Local\Temp\CISCO MAR -2023.exe
"C:\Users\Admin\AppData\Local\Temp\CISCO MAR -2023.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 1304
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 1828
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe

Filesize
224KB

MD5
b6404da30cc21b244a101b0a23a14709

SHA1
2d5ebc54fe027cada7eea7de141349229186df72

SHA256
1bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2

SHA512
a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe

Filesize
224KB

MD5
b6404da30cc21b244a101b0a23a14709

SHA1
2d5ebc54fe027cada7eea7de141349229186df72

SHA256
1bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2

SHA512
a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost..exe

Filesize
224KB

MD5
b6404da30cc21b244a101b0a23a14709

SHA1
2d5ebc54fe027cada7eea7de141349229186df72

SHA256
1bfecb5ea2cf955666f415d4c6a514f7c15b07629feb99caff3a09f94c1cbeb2

SHA512
a7d62064220958d16f0981efa13689333e84d0e054db97a665d0c5e8916b237e05d6476ad1f7280eb4a59be7758f2f4ba4b6fac2d0981ceeb996b08360bf415e

Download Submit
memory/928-146-0x0000000000E60000-0x0000000000E70000-memory.dmp

Filesize
64KB

Download
memory/4608-133-0x00000000010F0000-0x0000000001100000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads