Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220331-en -
submitted
11-04-2022 07:16
General
-
Target
0a90fcb89e5c36783d14359dfd0d2462.exe
-
Size
2.9MB
-
MD5
0a90fcb89e5c36783d14359dfd0d2462
-
SHA1
2ff0e1a4c591dfc6182c4f58209ae02210abff86
-
SHA256
09bbc753aa0ac277e42418b81587e1362c5dea6798432b3f589f0dae187d7953
-
SHA512
bf043ddd6c6c4ac363d4f62399be6eb396f6f8ece8310cd4164eaf7109a62c5e44b7f2a3e1eb75f47f8c11942dc7a47f25680f6ffd4314212f563dcea0f46b81
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a90fcb89e5c36783d14359dfd0d2462.exe"C:\Users\Admin\AppData\Local\Temp\0a90fcb89e5c36783d14359dfd0d2462.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe"C:\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 28322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4792 -ip 47921⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5369727c8448874edcbf2ad2db5f5271a
SHA1f962a928e24071d2cf63b3e67abaca1d40b840b7
SHA256fe06db434d5e0cca0d0c72627fc732bfca85d3708649464e5b61d814468ee739
SHA51211cd32a2284f611da89788622414065804aacdebfaba8c07c48d2ffe18b063df6e8f5945f119a4335ce15daa97a455237c578c02bcf85cf4827542a205cb0970
-
Filesize
2.0MB
MD5369727c8448874edcbf2ad2db5f5271a
SHA1f962a928e24071d2cf63b3e67abaca1d40b840b7
SHA256fe06db434d5e0cca0d0c72627fc732bfca85d3708649464e5b61d814468ee739
SHA51211cd32a2284f611da89788622414065804aacdebfaba8c07c48d2ffe18b063df6e8f5945f119a4335ce15daa97a455237c578c02bcf85cf4827542a205cb0970
-
Filesize
2.7MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
-
Filesize
64KB