5218893ef1bedd6c58665758eb7685407bf8622b932817217b8984984c40af08

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5218893ef1bedd6c58665758eb7685407bf8622b932817217b8984984c40af08.exe
Size

1.5MB
MD5

d1d23ae678acd80e179ca4547cda0a59
SHA1

5706ea93ee601df8dd134a4316e7dba47fdee4de
SHA256

5218893ef1bedd6c58665758eb7685407bf8622b932817217b8984984c40af08
SHA512

141b78bc0c6e516e488ee3138093e2aa56927619efdeb082aeeab665d1f5534973924871b6ef9be6ddea8cf4bfc0343b68f7dc7688018f20816c79ef3a346621
SSDEEP

49152:ygwRVgx6oCTT/veQKhb6deafWY3zWeica:ygwRVgELQb6lfFjWGa

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	5218893ef1bedd6c58665758eb7685407bf8622b932817217b8984984c40af08.exe

Executes dropped EXE 1 IoCs

pid	Process
1348	StartAllBackCfg.exe

Loads dropped DLL 1 IoCs

pid	Process
1348	StartAllBackCfg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
3624	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1348	StartAllBackCfg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 3624	224	5218893ef1bedd6c58665758eb7685407bf8622b932817217b8984984c40af08.exe	83
PID 224 wrote to memory of 3624	224	5218893ef1bedd6c58665758eb7685407bf8622b932817217b8984984c40af08.exe	83
PID 224 wrote to memory of 1348	224	5218893ef1bedd6c58665758eb7685407bf8622b932817217b8984984c40af08.exe	85
PID 224 wrote to memory of 1348	224	5218893ef1bedd6c58665758eb7685407bf8622b932817217b8984984c40af08.exe	85

C:\Users\Admin\AppData\Local\Temp\5218893ef1bedd6c58665758eb7685407bf8622b932817217b8984984c40af08.exe
"C:\Users\Admin\AppData\Local\Temp\5218893ef1bedd6c58665758eb7685407bf8622b932817217b8984984c40af08.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im StartAllBackCfg.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3624
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe" /install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe

Filesize
3.2MB

MD5
2f6a4bcead5598ab42571d5b84efdacc

SHA1
5148d1811b7fe1b5ce3761317a6b33eb3c8f093b

SHA256
4ec5b7e902672302d5ce89e3e731e1ba6b70d570a77980dddd5549cfa6f5329a

SHA512
632289ca585ea4d4a35d1a5d451391dccb1a99c047ffc9b5d82ea073cf606701c961b303670fd17f35bc50fa9585258813fd52ebd0fdfb4f7aadd0f50e8e35cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe

Filesize
3.2MB

MD5
2f6a4bcead5598ab42571d5b84efdacc

SHA1
5148d1811b7fe1b5ce3761317a6b33eb3c8f093b

SHA256
4ec5b7e902672302d5ce89e3e731e1ba6b70d570a77980dddd5549cfa6f5329a

SHA512
632289ca585ea4d4a35d1a5d451391dccb1a99c047ffc9b5d82ea073cf606701c961b303670fd17f35bc50fa9585258813fd52ebd0fdfb4f7aadd0f50e8e35cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackCfg.exe

Filesize
3.2MB

MD5
2f6a4bcead5598ab42571d5b84efdacc

SHA1
5148d1811b7fe1b5ce3761317a6b33eb3c8f093b

SHA256
4ec5b7e902672302d5ce89e3e731e1ba6b70d570a77980dddd5549cfa6f5329a

SHA512
632289ca585ea4d4a35d1a5d451391dccb1a99c047ffc9b5d82ea073cf606701c961b303670fd17f35bc50fa9585258813fd52ebd0fdfb4f7aadd0f50e8e35cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackX64.dll

Filesize
781KB

MD5
25af6dc90eb782edd0dc87a56f63b907

SHA1
6294fc824ae5a901977801625e7fbfc83f714794

SHA256
9a0c2a5eeddab097a5d2d1e6728e100005c0cbc6738e26237d642c325c64288e

SHA512
c04a71be0fdee5a9dcb11f419fbcce3a0b07c656f96dd5057616418a5417085a9cb77c4e77acee8c6a07cbf4063326f0008989e79289ae1e929c53f0d00a0656

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\StartAllBackX64.dll

Filesize
781KB

MD5
25af6dc90eb782edd0dc87a56f63b907

SHA1
6294fc824ae5a901977801625e7fbfc83f714794

SHA256
9a0c2a5eeddab097a5d2d1e6728e100005c0cbc6738e26237d642c325c64288e

SHA512
c04a71be0fdee5a9dcb11f419fbcce3a0b07c656f96dd5057616418a5417085a9cb77c4e77acee8c6a07cbf4063326f0008989e79289ae1e929c53f0d00a0656

Download Submit
memory/1348-253-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/1348-254-0x0000000000400000-0x000000000074A000-memory.dmp

Filesize
3.3MB

Download