Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13-04-2023 04:01
Static task
static1
Behavioral task
behavioral1
Sample
8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe
Resource
win10v2004-20230220-en
General
-
Target
8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe
-
Size
3.4MB
-
MD5
3651d9ca9d9a43985750f0de73f0c807
-
SHA1
15810e62673e4625b4c8c61ad37f4b48a4760f55
-
SHA256
8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0
-
SHA512
23f604c116eea0d4212740594eefe0b044d6e088fad17bbc073c97923e31cb28b53a570a375adf012dbb7f797827595e48bf9a781913f4c08ae0125e0d0a5e05
-
SSDEEP
98304:Ps+xhKoQJBwKhJ+O+uiXAqSuuWHoFN6WtljaEy9oFLOAkGkzdnEVomFHKnP:5oJpQAqSudHmN6WtljaEyqFLOyomFHKP
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4188-133-0x0000000002A70000-0x0000000002A96000-memory.dmp unk_chinese_botnet behavioral2/memory/4188-134-0x0000000010000000-0x0000000010027000-memory.dmp unk_chinese_botnet -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation 8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe -
Executes dropped EXE 1 IoCs
Processes:
Windowsfig.exepid process 448 Windowsfig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4524 448 WerFault.exe Windowsfig.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Windowsfig.exepid process 448 Windowsfig.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Windowsfig.exedescription pid process Token: SeDebugPrivilege 448 Windowsfig.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exedescription pid process target process PID 4188 wrote to memory of 448 4188 8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe Windowsfig.exe PID 4188 wrote to memory of 448 4188 8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe Windowsfig.exe PID 4188 wrote to memory of 448 4188 8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe Windowsfig.exe PID 4188 wrote to memory of 2092 4188 8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe cmd.exe PID 4188 wrote to memory of 2092 4188 8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe cmd.exe PID 4188 wrote to memory of 2092 4188 8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe"C:\Users\Admin\AppData\Local\Temp\8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Windowsfig.exe"C:\ProgramData\Windowsfig.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 22003⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /C "del /F /S /Q /A C:\ProgramData\Windowsfig.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 448 -ip 4481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
C:\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
C:\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_irdphcfg.3cr.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/448-174-0x0000000008F30000-0x0000000008F66000-memory.dmpFilesize
216KB
-
memory/448-177-0x0000000008FB0000-0x0000000008FD2000-memory.dmpFilesize
136KB
-
memory/448-162-0x00000000090A0000-0x00000000096C8000-memory.dmpFilesize
6.2MB
-
memory/448-163-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/448-195-0x0000000008780000-0x000000000878A000-memory.dmpFilesize
40KB
-
memory/448-173-0x0000000008ED0000-0x0000000008EEA000-memory.dmpFilesize
104KB
-
memory/448-194-0x00000000FFA10000-0x00000000FFA20000-memory.dmpFilesize
64KB
-
memory/448-175-0x0000000009D50000-0x000000000A3CA000-memory.dmpFilesize
6.5MB
-
memory/448-176-0x00000000096D0000-0x0000000009766000-memory.dmpFilesize
600KB
-
memory/448-161-0x0000000000B60000-0x0000000000B80000-memory.dmpFilesize
128KB
-
memory/448-178-0x0000000009770000-0x00000000097D6000-memory.dmpFilesize
408KB
-
memory/448-179-0x000000000A980000-0x000000000AF24000-memory.dmpFilesize
5.6MB
-
memory/448-180-0x0000000009040000-0x000000000905E000-memory.dmpFilesize
120KB
-
memory/448-181-0x0000000009830000-0x000000000987A000-memory.dmpFilesize
296KB
-
memory/448-182-0x000000000A7A0000-0x000000000A806000-memory.dmpFilesize
408KB
-
memory/448-183-0x000000000A770000-0x000000000A792000-memory.dmpFilesize
136KB
-
memory/448-193-0x0000000007B90000-0x0000000007BAE000-memory.dmpFilesize
120KB
-
memory/4188-133-0x0000000002A70000-0x0000000002A96000-memory.dmpFilesize
152KB
-
memory/4188-134-0x0000000010000000-0x0000000010027000-memory.dmpFilesize
156KB