ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Resubmissions

21/01/2024, 14:52

240121-r8syqaeac7 10

21/01/2024, 14:51

240121-r8k8waeac5 10

01/01/2024, 13:55

240101-q776kscacp 10

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
21/01/2024, 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Size

352KB
MD5

4f88b5e510ecbd0adefdfc87c552289c
SHA1

047ec67b8e3c001086284d7176b2d239db565fb5
SHA256

b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273
SHA512

75b86d6de4bec5285559f7e9a0dbf46df48dbdf78386023e5f8668a7814bc1db5322d8bf9d306cfd65175112b94366641d671175d59d3edacc3d2b2ba802f348
SSDEEP

6144:X9PrHO8306KFnBCzDIZXY3HJmui45mkA2/1:drHBpgkDuoEuXbJ

Score

9^/10

persistence ransomware

Malware Config

Signatures

Renames multiple (123) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe

Executes dropped EXE 1 IoCs

pid	Process
4588	dwa01.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{67B97992-033F-589A-AA66-FFC16ECB2C0C} = "C:\\Users\\Admin\\AppData\\Roaming\\dwa01.exe"	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{67B97992-033F-589A-AA66-FFC16ECB2C0C} = "notepad.exe \"C:\\Users\\Admin\\RECOVER-FILES.HTML\""	dwa01.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe
4588	dwa01.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4588	4884	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	94
PID 4884 wrote to memory of 4588	4884	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	94
PID 4884 wrote to memory of 4588	4884	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	94
PID 4884 wrote to memory of 4684	4884	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	93
PID 4884 wrote to memory of 4684	4884	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	93
PID 4884 wrote to memory of 4684	4884	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	93
PID 4588 wrote to memory of 4928	4588	dwa01.exe	100
PID 4588 wrote to memory of 4928	4588	dwa01.exe	100
PID 4588 wrote to memory of 4928	4588	dwa01.exe	100
PID 4588 wrote to memory of 1744	4588	dwa01.exe	99
PID 4588 wrote to memory of 1744	4588	dwa01.exe	99
PID 4588 wrote to memory of 1744	4588	dwa01.exe	99
PID 4588 wrote to memory of 1148	4588	dwa01.exe	98
PID 4588 wrote to memory of 1148	4588	dwa01.exe	98
PID 4588 wrote to memory of 1148	4588	dwa01.exe	98
PID 4588 wrote to memory of 4296	4588	dwa01.exe	109
PID 4588 wrote to memory of 4296	4588	dwa01.exe	109
PID 4588 wrote to memory of 4296	4588	dwa01.exe	109
PID 4588 wrote to memory of 4780	4588	dwa01.exe	110
PID 4588 wrote to memory of 4780	4588	dwa01.exe	110
PID 4588 wrote to memory of 4780	4588	dwa01.exe	110
PID 4296 wrote to memory of 2060	4296	cmd.exe	113
PID 4296 wrote to memory of 2060	4296	cmd.exe	113
PID 4296 wrote to memory of 2060	4296	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
"C:\Users\Admin\AppData\Local\Temp\b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\{372A2127-DF6F-AFBC-07E8-62C46839E3A5}.bat
  2⤵
  PID:4684
- C:\Users\Admin\AppData\Roaming\dwa01.exe
  "C:\Users\Admin\AppData\Roaming\dwa01.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin Delete Shadows /All /Quiet
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start /max notepad.exe "C:\Users\Admin\RECOVER-FILES.HTML"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\SysWOW64\notepad.exe
      notepad.exe "C:\Users\Admin\RECOVER-FILES.HTML"
      4⤵
      PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\{22D712E8-E330-9277-B1FA-BA09FD3269F9}.bat
    3⤵
    PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{22D712E8-E330-9277-B1FA-BA09FD3269F9}.bat

Filesize
120B

MD5
598c2707c8197e1a1fde5eed2bfb73bd

SHA1
4ce1f59601ca6f5892481bae3ec7530126711b24

SHA256
ce47464addcf6c7e68cb1597cd1cad319bb43f6905e06de11b5be32c3fffa8ff

SHA512
7247ac5b8e7fff4a8b1619de141a9eeea885a8887c4a5eb6eb3f8ce3f1061481a34ffa532658137f7ff96fb308570a6ea9595487451b7213bbed55af74c9487b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{372A2127-DF6F-AFBC-07E8-62C46839E3A5}.bat

Filesize
132B

MD5
f16ecf9f57b99fcff16b149dd7cc31d1

SHA1
b3549ce4e882977a25fda4e2affe94826ef4055e

SHA256
a9dd2be9fd2bc62a2ced854662676283e02a138d350c5f5c3d0de1d7f81369fd

SHA512
cce03073a895771fe43fbcfb16cca1e6e2a0763b62ca0a53413b1196b01aeed77300abf7fac1017c952295e86080d35aad3aa4e2e79e12faa477a25a4a0909a1

Download Submit
C:\Users\Admin\AppData\Roaming\dwa01.exe

Filesize
352KB

MD5
4f88b5e510ecbd0adefdfc87c552289c

SHA1
047ec67b8e3c001086284d7176b2d239db565fb5

SHA256
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273

SHA512
75b86d6de4bec5285559f7e9a0dbf46df48dbdf78386023e5f8668a7814bc1db5322d8bf9d306cfd65175112b94366641d671175d59d3edacc3d2b2ba802f348

Download Submit
C:\Users\Admin\Desktop\RECOVER-FILES.HTML

Filesize
4KB

MD5
33baa078b448a90305c10b86efa328a6

SHA1
f3bd12b6f201263750d47b258edc8675055274df

SHA256
97a6b72d011c09073ab29afc96712d4096205093c0ee26c2215ec9e81be35ad1

SHA512
242e3c4a79250ac348cc310ff4ba1218a68e149e98ef766ece5f5f943e6989d412286693b7e6ca5e935bcfd3b79c309f7dd58fe6d8a15624854e8a6ea026ac6c

Download Submit
memory/4588-56-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-39-0x00000000023B0000-0x0000000002419000-memory.dmp

Filesize
420KB

Download
memory/4588-694-0x0000000003EF0000-0x0000000003F20000-memory.dmp

Filesize
192KB

Download
memory/4588-689-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

Filesize
4KB

Download
memory/4588-71-0x0000000003EF0000-0x0000000003F20000-memory.dmp

Filesize
192KB

Download
memory/4588-62-0x0000000003EF0000-0x0000000003F20000-memory.dmp

Filesize
192KB

Download
memory/4588-61-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

Filesize
4KB

Download
memory/4588-60-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

Filesize
4KB

Download
memory/4588-59-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-58-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-57-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-47-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-36-0x00000000023B0000-0x0000000002419000-memory.dmp

Filesize
420KB

Download
memory/4588-37-0x00000000023B0000-0x0000000002419000-memory.dmp

Filesize
420KB

Download
memory/4588-38-0x00000000023B0000-0x0000000002419000-memory.dmp

Filesize
420KB

Download
memory/4588-55-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-41-0x00000000023B0000-0x0000000002419000-memory.dmp

Filesize
420KB

Download
memory/4588-43-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-44-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-42-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-49-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4588-50-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4588-46-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-48-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4588-45-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-40-0x00000000023B0000-0x0000000002419000-memory.dmp

Filesize
420KB

Download
memory/4588-52-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4588-54-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4588-53-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4588-51-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4884-2-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4884-5-0x0000000003C00000-0x0000000003D00000-memory.dmp

Filesize
1024KB

Download
memory/4884-1-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4884-4-0x0000000002470000-0x00000000024D9000-memory.dmp

Filesize
420KB

Download
memory/4884-13-0x0000000003F10000-0x0000000003F40000-memory.dmp

Filesize
192KB

Download
memory/4884-12-0x0000000003C00000-0x0000000003D00000-memory.dmp

Filesize
1024KB

Download
memory/4884-11-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4884-9-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4884-10-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4884-8-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4884-3-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4884-7-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4884-6-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4884-0-0x0000000002470000-0x00000000024D9000-memory.dmp

Filesize
420KB

Download