ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

max time kernel
93s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Size

352KB
MD5

4f88b5e510ecbd0adefdfc87c552289c
SHA1

047ec67b8e3c001086284d7176b2d239db565fb5
SHA256

b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273
SHA512

75b86d6de4bec5285559f7e9a0dbf46df48dbdf78386023e5f8668a7814bc1db5322d8bf9d306cfd65175112b94366641d671175d59d3edacc3d2b2ba802f348
SSDEEP

6144:X9PrHO8306KFnBCzDIZXY3HJmui45mkA2/1:drHBpgkDuoEuXbJ

Score

9^/10

persistence ransomware

Malware Config

Signatures

Renames multiple (101) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe

Executes dropped EXE 1 IoCs

pid	Process
4776	dwa01.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{67B97992-033F-589A-AA66-FFC16ECB2C0C} = "C:\\Users\\Admin\\AppData\\Roaming\\dwa01.exe"	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{67B97992-033F-589A-AA66-FFC16ECB2C0C} = "notepad.exe \"C:\\Users\\Admin\\RECOVER-FILES.HTML\""	dwa01.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe
4776	dwa01.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4776	4864	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	88
PID 4864 wrote to memory of 4776	4864	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	88
PID 4864 wrote to memory of 4776	4864	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	88
PID 4864 wrote to memory of 2860	4864	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	89
PID 4864 wrote to memory of 2860	4864	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	89
PID 4864 wrote to memory of 2860	4864	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	89
PID 4776 wrote to memory of 2400	4776	dwa01.exe	100
PID 4776 wrote to memory of 2400	4776	dwa01.exe	100
PID 4776 wrote to memory of 2400	4776	dwa01.exe	100
PID 4776 wrote to memory of 5088	4776	dwa01.exe	99
PID 4776 wrote to memory of 5088	4776	dwa01.exe	99
PID 4776 wrote to memory of 5088	4776	dwa01.exe	99
PID 4776 wrote to memory of 5044	4776	dwa01.exe	98
PID 4776 wrote to memory of 5044	4776	dwa01.exe	98
PID 4776 wrote to memory of 5044	4776	dwa01.exe	98
PID 4776 wrote to memory of 3612	4776	dwa01.exe	105
PID 4776 wrote to memory of 3612	4776	dwa01.exe	105
PID 4776 wrote to memory of 3612	4776	dwa01.exe	105
PID 4776 wrote to memory of 4400	4776	dwa01.exe	106
PID 4776 wrote to memory of 4400	4776	dwa01.exe	106
PID 4776 wrote to memory of 4400	4776	dwa01.exe	106
PID 3612 wrote to memory of 3148	3612	cmd.exe	109
PID 3612 wrote to memory of 3148	3612	cmd.exe	109
PID 3612 wrote to memory of 3148	3612	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
"C:\Users\Admin\AppData\Local\Temp\b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Roaming\dwa01.exe
  "C:\Users\Admin\AppData\Roaming\dwa01.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin Delete Shadows /All /Quiet
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start /max notepad.exe "C:\Users\Admin\RECOVER-FILES.HTML"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Windows\SysWOW64\notepad.exe
      notepad.exe "C:\Users\Admin\RECOVER-FILES.HTML"
      4⤵
      PID:3148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\{92FD306A-4FB0-962E-190D-64D85D6F24EF}.bat
    3⤵
    PID:4400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\{1CF890A0-CA01-7E19-84A4-8EEEE37AE679}.bat
  2⤵
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{1CF890A0-CA01-7E19-84A4-8EEEE37AE679}.bat

Filesize
132B

MD5
f16ecf9f57b99fcff16b149dd7cc31d1

SHA1
b3549ce4e882977a25fda4e2affe94826ef4055e

SHA256
a9dd2be9fd2bc62a2ced854662676283e02a138d350c5f5c3d0de1d7f81369fd

SHA512
cce03073a895771fe43fbcfb16cca1e6e2a0763b62ca0a53413b1196b01aeed77300abf7fac1017c952295e86080d35aad3aa4e2e79e12faa477a25a4a0909a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92FD306A-4FB0-962E-190D-64D85D6F24EF}.bat

Filesize
120B

MD5
598c2707c8197e1a1fde5eed2bfb73bd

SHA1
4ce1f59601ca6f5892481bae3ec7530126711b24

SHA256
ce47464addcf6c7e68cb1597cd1cad319bb43f6905e06de11b5be32c3fffa8ff

SHA512
7247ac5b8e7fff4a8b1619de141a9eeea885a8887c4a5eb6eb3f8ce3f1061481a34ffa532658137f7ff96fb308570a6ea9595487451b7213bbed55af74c9487b

Download Submit
C:\Users\Admin\AppData\Roaming\dwa01.exe

Filesize
352KB

MD5
4f88b5e510ecbd0adefdfc87c552289c

SHA1
047ec67b8e3c001086284d7176b2d239db565fb5

SHA256
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273

SHA512
75b86d6de4bec5285559f7e9a0dbf46df48dbdf78386023e5f8668a7814bc1db5322d8bf9d306cfd65175112b94366641d671175d59d3edacc3d2b2ba802f348

Download Submit
C:\Users\Admin\Desktop\RECOVER-FILES.HTML

Filesize
4KB

MD5
2a1ca98c121bcdb45a5ac43c5459fe12

SHA1
86e37f62dc812572cb82767228ea5cf7601c3937

SHA256
67a23378b11442280e0cf5922090c2d0c28c9a4c05204a27a24510969754537b

SHA512
13364b9abff65b6e0aeddc89a0932f9053e61d42c5801794564dc2c7aab0e512fcd07e797504dd5b8fff5fa4ff9eda48c7c20aebbb107df6ef40a4945c6b3cce

Download Submit
memory/4776-42-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4776-46-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

Filesize
4KB

Download
memory/4776-569-0x0000000003EF0000-0x0000000003F20000-memory.dmp

Filesize
192KB

Download
memory/4776-564-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

Filesize
4KB

Download
memory/4776-56-0x0000000003EF0000-0x0000000003F20000-memory.dmp

Filesize
192KB

Download
memory/4776-47-0x0000000003EF0000-0x0000000003F20000-memory.dmp

Filesize
192KB

Download
memory/4776-45-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4776-44-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4776-43-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4776-41-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4776-34-0x00000000022F0000-0x0000000002359000-memory.dmp

Filesize
420KB

Download
memory/4776-35-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4776-36-0x00000000022F0000-0x0000000002359000-memory.dmp

Filesize
420KB

Download
memory/4776-38-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4776-37-0x0000000003BE0000-0x0000000003CE0000-memory.dmp

Filesize
1024KB

Download
memory/4776-39-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4776-40-0x0000000003BE0000-0x0000000003BE1000-memory.dmp

Filesize
4KB

Download
memory/4864-3-0x00000000022E0000-0x0000000002349000-memory.dmp

Filesize
420KB

Download
memory/4864-4-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4864-11-0x0000000003F10000-0x0000000003F40000-memory.dmp

Filesize
192KB

Download
memory/4864-0-0x00000000022E0000-0x0000000002349000-memory.dmp

Filesize
420KB

Download
memory/4864-10-0x0000000003D00000-0x0000000003D01000-memory.dmp

Filesize
4KB

Download
memory/4864-5-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4864-9-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4864-8-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4864-2-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4864-7-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4864-6-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download
memory/4864-1-0x0000000003C00000-0x0000000003C01000-memory.dmp

Filesize
4KB

Download