Overview

overview

10

Static

static

c3b5b082a3...00.exe

windows7_x64

10

c3b5b082a3...00.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    153s
  • max time network
    205s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12/05/2022, 05:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c3b5b082a3aa2ba15f5ea7971d837b00.exe
  • Size 1.5MB
  • Sample220512-fry8maaef3
  • SHA256 7f9ffa637f4e13d1919bea687ac61c2263dfc762ee6bc95bdf6b5ccc4b7e8b8a
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3b5b082a3aa2ba15f5ea7971d837b00.exe
    "C:\Users\Admin\AppData\Local\Temp\c3b5b082a3aa2ba15f5ea7971d837b00.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Users\Admin\AppData\Local\Temp\build.sfx.exe
        build.sfx.exe -p123
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:2296
        • C:\Users\Admin\AppData\Local\Temp\build.exe
          "C:\Users\Admin\AppData\Local\Temp\build.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetWindowsHookEx
          PID:1164

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1.bat
        • Path C:\Users\Admin\AppData\Local\Temp\1.bat
        • Size 38B
        • SHA256 a9d4ae368e3a80b1463e2a3f6355df7956d019495e629c6742b234b98fe438e5
        • MD5 SHA1 SHA512
        Submit Download

        build.exe
        • Path C:\Users\Admin\AppData\Local\Temp\build.exe
        • Size 1.1MB
        • SHA256 d31dd64e3df970a07d7a59d0f2d65d12dfeb09fb48605daedcb2863f6bc7c77e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        build.exe
        • Path C:\Users\Admin\AppData\Local\Temp\build.exe
        • Size 1.1MB
        • SHA256 d31dd64e3df970a07d7a59d0f2d65d12dfeb09fb48605daedcb2863f6bc7c77e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        build.sfx.exe
        • Path C:\Users\Admin\AppData\Local\Temp\build.sfx.exe
        • Size 1.4MB
        • SHA256 bd62479fdeb0a1ae9a6275e4d2c6ed4ea60c3fcdf6da0297a25b48cce699a855
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        build.sfx.exe
        • Path C:\Users\Admin\AppData\Local\Temp\build.sfx.exe
        • Size 1.4MB
        • SHA256 bd62479fdeb0a1ae9a6275e4d2c6ed4ea60c3fcdf6da0297a25b48cce699a855
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1164-138-0x0000000074880000-0x0000000074E31000-memory.dmp
        Download