Overview
overview
10Static
static
107zS850A099...ed.exe
windows7_x64
107zS850A099...ed.exe
windows10-2004_x64
107zS850A099...1a.exe
windows7_x64
87zS850A099...1a.exe
windows10-2004_x64
87zS850A099...b7.exe
windows7_x64
107zS850A099...b7.exe
windows10-2004_x64
107zS850A099...5e.exe
windows7_x64
107zS850A099...5e.exe
windows10-2004_x64
17zS850A099...a0.exe
windows7_x64
107zS850A099...a0.exe
windows10-2004_x64
107zS850A099...95.exe
windows7_x64
77zS850A099...95.exe
windows10-2004_x64
77zS850A099...cb.exe
windows7_x64
107zS850A099...cb.exe
windows10-2004_x64
17zS850A099...58.exe
windows7_x64
107zS850A099...58.exe
windows10-2004_x64
107zS850A099...7f.exe
windows7_x64
107zS850A099...7f.exe
windows10-2004_x64
107zS850A099...32.exe
windows7_x64
107zS850A099...32.exe
windows10-2004_x64
107zS850A099...c3.exe
windows7_x64
87zS850A099...c3.exe
windows10-2004_x64
107zS850A099...e9.exe
windows7_x64
67zS850A099...e9.exe
windows10-2004_x64
17zS850A099...8c.exe
windows7_x64
107zS850A099...8c.exe
windows10-2004_x64
17zS850A099...8c.exe
windows7_x64
77zS850A099...8c.exe
windows10-2004_x64
87zS850A099...ll.exe
windows7_x64
107zS850A099...ll.exe
windows10-2004_x64
10Analysis
-
max time kernel
42s -
max time network
90s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20-01-2022 18:11
Behavioral task
behavioral1
Sample
7zS850A099E/61e74fd2175cb_Tue23956aa60ed.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7zS850A099E/61e74fd2175cb_Tue23956aa60ed.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral3
Sample
7zS850A099E/61e74fd3252fe_Tue23df2ad021a.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
7zS850A099E/61e74fd3252fe_Tue23df2ad021a.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral5
Sample
7zS850A099E/61e74fd41f841_Tue2365aa82b7.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
7zS850A099E/61e74fd41f841_Tue2365aa82b7.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral7
Sample
7zS850A099E/61e74fd53f766_Tue23ec97445e.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
7zS850A099E/61e74fd53f766_Tue23ec97445e.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral9
Sample
7zS850A099E/61e74fd78769f_Tue234b6c24d9a0.exe
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
7zS850A099E/61e74fd78769f_Tue234b6c24d9a0.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral11
Sample
7zS850A099E/61e74fd8ef830_Tue23593425095.exe
Resource
win7-en-20211208
Behavioral task
behavioral12
Sample
7zS850A099E/61e74fd8ef830_Tue23593425095.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral13
Sample
7zS850A099E/61e74fda51500_Tue23260baecb.exe
Resource
win7-en-20211208
Behavioral task
behavioral14
Sample
7zS850A099E/61e74fda51500_Tue23260baecb.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral15
Sample
7zS850A099E/61e7501ab629f_Tue23c4645058.exe
Resource
win7-en-20211208
Behavioral task
behavioral16
Sample
7zS850A099E/61e7501ab629f_Tue23c4645058.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral17
Sample
7zS850A099E/61e7501b7eabe_Tue2344597f.exe
Resource
win7-en-20211208
Behavioral task
behavioral18
Sample
7zS850A099E/61e7501b7eabe_Tue2344597f.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral19
Sample
7zS850A099E/61e7501c830d6_Tue23bdf4712a32.exe
Resource
win7-en-20211208
Behavioral task
behavioral20
Sample
7zS850A099E/61e7501c830d6_Tue23bdf4712a32.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral21
Sample
7zS850A099E/61e7501db65f3_Tue23c7b395c3.exe
Resource
win7-en-20211208
Behavioral task
behavioral22
Sample
7zS850A099E/61e7501db65f3_Tue23c7b395c3.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral23
Sample
7zS850A099E/61e7502b8389b_Tue233252e9.exe
Resource
win7-en-20211208
Behavioral task
behavioral24
Sample
7zS850A099E/61e7502b8389b_Tue233252e9.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral25
Sample
7zS850A099E/61e7502c4cff3_Tue232cba58c.exe
Resource
win7-en-20211208
Behavioral task
behavioral26
Sample
7zS850A099E/61e7502c4cff3_Tue232cba58c.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral27
Sample
7zS850A099E/61e7502f007f3_Tue23d6fecf8c.exe
Resource
win7-en-20211208
Behavioral task
behavioral28
Sample
7zS850A099E/61e7502f007f3_Tue23d6fecf8c.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral29
Sample
7zS850A099E/setup_install.exe
Resource
win7-en-20211208
Behavioral task
behavioral30
Sample
7zS850A099E/setup_install.exe
Resource
win10v2004-en-20220112
General
-
Target
7zS850A099E/61e7502f007f3_Tue23d6fecf8c.exe
-
Size
116KB
-
MD5
b8ecec542a07067a193637269973c2e8
-
SHA1
97178479fd0fc608d6c0fbf243a0bb136d7b0ecb
-
SHA256
fc6b5ec20b7f2c902e9413c71be5718eb58640d86189306fe4c592af70fe3b7e
-
SHA512
730d74a72c7af91b10f06ae98235792740bed2afc86eb8ddc15ecaf7c31ec757ac3803697644ac0f60c2e8e0fd875b94299763ac0fed74d392ac828b61689893
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
D629.tmp.exeE8C8.tmp.exepid process 2580 D629.tmp.exe 3744 E8C8.tmp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
61e7502f007f3_Tue23d6fecf8c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 61e7502f007f3_Tue23d6fecf8c.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
61e7502f007f3_Tue23d6fecf8c.execmd.exedescription pid process target process PID 2192 wrote to memory of 2580 2192 61e7502f007f3_Tue23d6fecf8c.exe D629.tmp.exe PID 2192 wrote to memory of 2580 2192 61e7502f007f3_Tue23d6fecf8c.exe D629.tmp.exe PID 2192 wrote to memory of 2580 2192 61e7502f007f3_Tue23d6fecf8c.exe D629.tmp.exe PID 2192 wrote to memory of 3744 2192 61e7502f007f3_Tue23d6fecf8c.exe E8C8.tmp.exe PID 2192 wrote to memory of 3744 2192 61e7502f007f3_Tue23d6fecf8c.exe E8C8.tmp.exe PID 2192 wrote to memory of 3744 2192 61e7502f007f3_Tue23d6fecf8c.exe E8C8.tmp.exe PID 2192 wrote to memory of 312 2192 61e7502f007f3_Tue23d6fecf8c.exe cmd.exe PID 2192 wrote to memory of 312 2192 61e7502f007f3_Tue23d6fecf8c.exe cmd.exe PID 2192 wrote to memory of 312 2192 61e7502f007f3_Tue23d6fecf8c.exe cmd.exe PID 312 wrote to memory of 2104 312 cmd.exe PING.EXE PID 312 wrote to memory of 2104 312 cmd.exe PING.EXE PID 312 wrote to memory of 2104 312 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e7502f007f3_Tue23d6fecf8c.exe"C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e7502f007f3_Tue23d6fecf8c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\D629.tmp.exe"C:\Users\Admin\AppData\Roaming\D629.tmp.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\E8C8.tmp.exe"C:\Users\Admin\AppData\Roaming\E8C8.tmp.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\7zS850A099E\61e7502f007f3_Tue23d6fecf8c.exe" >> NUL2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\D629.tmp.exeMD5
446119332738133d3ecd2d00ebe5d0ec
SHA183c4c026ac8bffb9287a5b9ade2e93d4dcc50709
SHA2565718e48ba5305adeea0390ca7cce071cc86f2c3d03560842f9067aad3d92193f
SHA512d185fcd61861020ed6385650d4bbaeac9c6f4eba6e79164dce65cb96e4cac6360d9a49444fa0a4c1c01e5579eff495f82712d9b1e73d6d5f35a3459ac038600f
-
C:\Users\Admin\AppData\Roaming\D629.tmp.exeMD5
446119332738133d3ecd2d00ebe5d0ec
SHA183c4c026ac8bffb9287a5b9ade2e93d4dcc50709
SHA2565718e48ba5305adeea0390ca7cce071cc86f2c3d03560842f9067aad3d92193f
SHA512d185fcd61861020ed6385650d4bbaeac9c6f4eba6e79164dce65cb96e4cac6360d9a49444fa0a4c1c01e5579eff495f82712d9b1e73d6d5f35a3459ac038600f
-
C:\Users\Admin\AppData\Roaming\E8C8.tmp.exeMD5
4d75dea49f6bd60f725fae9c28cd0960
SHA139875c55b440554253b32d581e1c1e01bd50eb90
SHA256f780f1b37685e902aa4910e5a6d62c7a209f002f88c83598b30ca804f5f4e1f0
SHA512fda61a9cc6a78b6949d4d959b090e84e09f1d41d0b63daa843e28a0666e6989adf25130787f91f5d9e0a3c37ed4bb0ba7b98ed54ac4a0236176124ba0baf9ce5
-
C:\Users\Admin\AppData\Roaming\E8C8.tmp.exeMD5
4d75dea49f6bd60f725fae9c28cd0960
SHA139875c55b440554253b32d581e1c1e01bd50eb90
SHA256f780f1b37685e902aa4910e5a6d62c7a209f002f88c83598b30ca804f5f4e1f0
SHA512fda61a9cc6a78b6949d4d959b090e84e09f1d41d0b63daa843e28a0666e6989adf25130787f91f5d9e0a3c37ed4bb0ba7b98ed54ac4a0236176124ba0baf9ce5