Analysis
- max time kernel
142s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20230621-en - resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system - submitted
03/07/2023, 09:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
REQ Supplier Survey UkraineRussa conflict.exe
Resource
win7-20230621-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
REQ Supplier Survey UkraineRussa conflict.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target REQ Supplier Survey UkraineRussa conflict.exe
- Size 262KB
- Sample230703-lcf2dsha9t
- SHA256 d77523803125e052acea94494e7a44be5ff7a5bb79b5de28b52e46c0f0f2f0ab
- MD5 372c41f00d904111ebf0908b83fb97b2
- SHA1 ddce6774c4ccdf42545d0f1e5cc28d09b9c68522
- SHA512 551aad6450ed43d4a4711b8f807038bd1b6dc56d9255244ff0cc55b8e27a35184978253e741e9d3b85af72e03a52c40848b921b2cfb1aa28ede7a520b1038b5a
- SSDEEP 6144:/Ya6VwPJdtxCIZ9N0319mTMEkN9xJb0nsothRRc0nBeAozhhMrPpLaaN1oFAS6:/Y3OXuu9N033mgr07JBrzrpNN1oF6
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\Control Panel\International\Geo\Nation REQ Supplier Survey UkraineRussa conflict.exe - Loads dropped DLL 1 IoCs
pid Process 2476 REQ Supplier Survey UkraineRussa conflict.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4025927695-1301755775-2607443251-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pyyieenjjs = "C:\\Users\\Admin\\AppData\\Roaming\\irbbwff\\bkkt.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\REQ Supplier Survey UkraineRussa conflict.exe\"" REQ Supplier Survey UkraineRussa conflict.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2476 set thread context of 3052 2476 REQ Supplier Survey UkraineRussa conflict.exe 79 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe 3052 REQ Supplier Survey UkraineRussa conflict.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2476 REQ Supplier Survey UkraineRussa conflict.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3052 REQ Supplier Survey UkraineRussa conflict.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2476 wrote to memory of 3052 2476 REQ Supplier Survey UkraineRussa conflict.exe 79 PID 2476 wrote to memory of 3052 2476 REQ Supplier Survey UkraineRussa conflict.exe 79 PID 2476 wrote to memory of 3052 2476 REQ Supplier Survey UkraineRussa conflict.exe 79 PID 2476 wrote to memory of 3052 2476 REQ Supplier Survey UkraineRussa conflict.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\REQ Supplier Survey UkraineRussa conflict.exe"C:\Users\Admin\AppData\Local\Temp\REQ Supplier Survey UkraineRussa conflict.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\REQ Supplier Survey UkraineRussa conflict.exe"C:\Users\Admin\AppData\Local\Temp\REQ Supplier Survey UkraineRussa conflict.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsd7853.tmp\ugjnmxflvj.dll
- Size 22KB
- SHA256 9a5f71aa947c26f87c1e40d67b976f1c720f9bb9b01538147311a21dbec5bd36
- MD5 b0df0927a5b680ec219d1596234256cb
- SHA1 47bf58ba173bdf358da0de3bc84e09037c81ec79
- SHA512 3df9eb4fc66970011f3ca10dcd79b7a338b696f85478ca6be9bf111015bda3cd26bc629334eda7fab2fa1391ab0955d626e54bf1a8bf6108dbc160685d70cb49
- SSDEEP 192:eULkIAXmcxPhQc+Q8t4+gaECeZJaJewLRsutxFBXgGW8fEvMCALnN7kNt/E/ghWK:nGlmEWsuPXjW8fPNQfEfoDCCtZBMs
- MD5 SHA1 SHA512 SSDEEP