b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73

Resubmissions

27/03/2023, 08:26

230327-kcbk8see71 7

23/12/2022, 04:08

221223-eqd1maah8x 8

23/12/2022, 03:43

221223-d946gsfg43 8

Analysis

max time kernel
1794s
max time network
1769s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2023, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
Size

1006KB
MD5

8fb066db4762a35fac7f31cedd97cab7
SHA1

5e77aa679dba9ce1ba300de84c40e86f4b8d3864
SHA256

b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73
SHA512

2d9104e01763315394103ca44b17ce702e7aa86e098c75f8497a2a9df175ef5ed53015b2520d7c35d2f713e566e4ae987aad9f4e1497b248bc3099f09b0ca498
SSDEEP

24576:6RL1fJwm75YaYh0kpwIzOalXqBpSnJh9whgefucd9Tb7:CxRwm1lYhLpwISIXqzSn/9whBfbxb

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe

Executes dropped EXE 2 IoCs

pid	Process
1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
2844	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4208 set thread context of 1500	4208	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	94
PID 1996 set thread context of 2844	1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2636	powershell.exe
2636	powershell.exe
4208	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
4420	powershell.exe
4420	powershell.exe
3624	powershell.exe
3624	powershell.exe
1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	4208	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
Token: SeDebugPrivilege	1500	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
Token: SeDebugPrivilege	2844	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 2636	4208	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	87
PID 4208 wrote to memory of 2636	4208	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	87
PID 4208 wrote to memory of 1500	4208	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	94
PID 4208 wrote to memory of 1500	4208	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	94
PID 4208 wrote to memory of 1500	4208	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	94
PID 4208 wrote to memory of 1500	4208	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	94
PID 4208 wrote to memory of 1500	4208	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	94
PID 4208 wrote to memory of 1500	4208	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	94
PID 1500 wrote to memory of 4420	1500	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	95
PID 1500 wrote to memory of 4420	1500	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	95
PID 1996 wrote to memory of 3624	1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	98
PID 1996 wrote to memory of 3624	1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	98
PID 1996 wrote to memory of 2844	1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	100
PID 1996 wrote to memory of 2844	1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	100
PID 1996 wrote to memory of 2844	1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	100
PID 1996 wrote to memory of 2844	1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	100
PID 1996 wrote to memory of 2844	1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	100
PID 1996 wrote to memory of 2844	1996	b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
"C:\Users\Admin\AppData\Local\Temp\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
  C:\Users\Admin\AppData\Local\Temp\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 3; Set-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4420

C:\Users\Admin\AppData\Roaming\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
C:\Users\Admin\AppData\Roaming\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3624
- C:\Users\Admin\AppData\Roaming\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
  C:\Users\Admin\AppData\Roaming\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe.log

Filesize
1KB

MD5
cde7fd64be09b0eba117a32e8f9fa5f8

SHA1
fd6ad41a1a33d453a1ac0bbe916b19be7bfd00b7

SHA256
0db4af16047106c35f28911fb8ffc495c7e656ba2fd2a4606be1a6779abe39e0

SHA512
65a6fb91efeba69d83209cbc23b22ac103b53bfc71b281f04debc662307e703e107f4273c472843eb420541ad88608bcb03be64e47be6b0649b3affacc86f823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fa43c5d409237063705a8aa3a5868f25

SHA1
7bb83b3ed1aae19408f08cd6df8a53fd038575f8

SHA256
c9c99092d4b96c7ebf347ea548ac9e36c63d06b6e361b1e8c84fac269200ee78

SHA512
865422d5187a87bfbd158c6beae2e996067a0bd82f9fc336c8c26b5e390d2c7ad9634f794a252a2979b6036122eaccec4e56898fdd97d629a1474b8f72bcc1a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e89c193840c8fb53fc3de104b1c4b092

SHA1
8b41b6a392780e48cc33e673cf4412080c42981e

SHA256
920b0533da0c372d9d48d36e09d752c369aec8f67c334e98940909bfcb6c0e6c

SHA512
865667a22e741c738c62582f0f06ea4559bb63a1f0410065c6fb3da80667582697aba2e233e91068c02d9ab4fb5db282a681fe8234f4c77a5309b689a37ac3a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sqabjpjc.0b5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe

Filesize
1006KB

MD5
8fb066db4762a35fac7f31cedd97cab7

SHA1
5e77aa679dba9ce1ba300de84c40e86f4b8d3864

SHA256
b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73

SHA512
2d9104e01763315394103ca44b17ce702e7aa86e098c75f8497a2a9df175ef5ed53015b2520d7c35d2f713e566e4ae987aad9f4e1497b248bc3099f09b0ca498

Download Submit
C:\Users\Admin\AppData\Roaming\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe

Filesize
1006KB

MD5
8fb066db4762a35fac7f31cedd97cab7

SHA1
5e77aa679dba9ce1ba300de84c40e86f4b8d3864

SHA256
b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73

SHA512
2d9104e01763315394103ca44b17ce702e7aa86e098c75f8497a2a9df175ef5ed53015b2520d7c35d2f713e566e4ae987aad9f4e1497b248bc3099f09b0ca498

Download Submit
C:\Users\Admin\AppData\Roaming\b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73.exe

Filesize
1006KB

MD5
8fb066db4762a35fac7f31cedd97cab7

SHA1
5e77aa679dba9ce1ba300de84c40e86f4b8d3864

SHA256
b7581c0e2dc71578ffd55e69ce2c306a4372b8d11a4f34d2eb2ba7780e757b73

SHA512
2d9104e01763315394103ca44b17ce702e7aa86e098c75f8497a2a9df175ef5ed53015b2520d7c35d2f713e566e4ae987aad9f4e1497b248bc3099f09b0ca498

Download Submit
memory/1500-799-0x0000000140000000-0x0000000140078000-memory.dmp

Filesize
480KB

Download
memory/1500-1108-0x000001BA39780000-0x000001BA39790000-memory.dmp

Filesize
64KB

Download
memory/1500-1611-0x000001BA39780000-0x000001BA39790000-memory.dmp

Filesize
64KB

Download
memory/1996-1626-0x0000018951AD0000-0x0000018951AE0000-memory.dmp

Filesize
64KB

Download
memory/1996-2286-0x0000018951AD0000-0x0000018951AE0000-memory.dmp

Filesize
64KB

Download
memory/1996-2294-0x0000018951AD0000-0x0000018951AE0000-memory.dmp

Filesize
64KB

Download
memory/1996-2292-0x0000018951AD0000-0x0000018951AE0000-memory.dmp

Filesize
64KB

Download
memory/2636-792-0x00000268FB2A0000-0x00000268FB2B0000-memory.dmp

Filesize
64KB

Download
memory/2636-793-0x00000268FB2A0000-0x00000268FB2B0000-memory.dmp

Filesize
64KB

Download
memory/2636-787-0x00000268FB2A0000-0x00000268FB2B0000-memory.dmp

Filesize
64KB

Download
memory/2636-788-0x00000268FB2A0000-0x00000268FB2B0000-memory.dmp

Filesize
64KB

Download
memory/2636-789-0x00000268FB2A0000-0x00000268FB2B0000-memory.dmp

Filesize
64KB

Download
memory/2636-791-0x00000268FB2A0000-0x00000268FB2B0000-memory.dmp

Filesize
64KB

Download
memory/2844-3106-0x000002174C650000-0x000002174C660000-memory.dmp

Filesize
64KB

Download
memory/2844-2596-0x000002174C650000-0x000002174C660000-memory.dmp

Filesize
64KB

Download
memory/3624-2287-0x000002D3C2E10000-0x000002D3C2E20000-memory.dmp

Filesize
64KB

Download
memory/3624-2283-0x000002D3C2E10000-0x000002D3C2E20000-memory.dmp

Filesize
64KB

Download
memory/3624-2284-0x000002D3C2E10000-0x000002D3C2E20000-memory.dmp

Filesize
64KB

Download
memory/3624-2285-0x000002D3C2E10000-0x000002D3C2E20000-memory.dmp

Filesize
64KB

Download
memory/3624-2289-0x000002D3C2E10000-0x000002D3C2E20000-memory.dmp

Filesize
64KB

Download
memory/3624-2288-0x000002D3C2E10000-0x000002D3C2E20000-memory.dmp

Filesize
64KB

Download
memory/4208-164-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-166-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-192-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-194-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-196-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-198-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-777-0x000001E9AF270000-0x000001E9AF292000-memory.dmp

Filesize
136KB

Download
memory/4208-188-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-186-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-184-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-182-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-790-0x000001E9C8BC0000-0x000001E9C8BD0000-memory.dmp

Filesize
64KB

Download
memory/4208-180-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-178-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-176-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-174-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-172-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-170-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-168-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-190-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-133-0x000001E9AD360000-0x000001E9AD460000-memory.dmp

Filesize
1024KB

Download
memory/4208-162-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-160-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-158-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-134-0x000001E9C8BC0000-0x000001E9C8BD0000-memory.dmp

Filesize
64KB

Download
memory/4208-135-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-136-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-156-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-154-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-152-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-150-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-148-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-146-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-144-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-142-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-140-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4208-138-0x000001E9C9740000-0x000001E9C983A000-memory.dmp

Filesize
1000KB

Download
memory/4420-1629-0x000001F7FF2F0000-0x000001F7FF300000-memory.dmp

Filesize
64KB

Download
memory/4420-1628-0x000001F7FF2F0000-0x000001F7FF300000-memory.dmp

Filesize
64KB

Download
memory/4420-1627-0x000001F7FF2F0000-0x000001F7FF300000-memory.dmp

Filesize
64KB

Download