Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
18-05-2022 22:16
General
-
Target
ff72b295ded9889cee24320db368bcf1.exe
-
Size
809KB
-
MD5
ff72b295ded9889cee24320db368bcf1
-
SHA1
5d7991f8495d56088710dd558faba639ffd05292
-
SHA256
e54ccfd9a2ab15b4461eb38baec21eb828f7757ca3e67db3b7acb261be34adcd
-
SHA512
37ab209741e90c78565d170ab48d7ee83c8633e93e646a4c8f639c305c8b6528841668b6aa7797870612d24e11e1ff1aaae0f5622e9a2195957f9142e93a7b1b
Malware Config
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff72b295ded9889cee24320db368bcf1.exe"C:\Users\Admin\AppData\Local\Temp\ff72b295ded9889cee24320db368bcf1.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn TxMT8hHkO8fBB5FlBurdwljpn /tr "C:\ProgramData\4vFAHkNczECIXuLdvBZKuXofw\IFMb39aGmCsqJcthXwNQEToq7.exe" /st 00:22 /du 23:59 /sc daily /ri 1 /f2⤵
- Creates scheduled task(s)
-
-
C:\ProgramData\4vFAHkNczECIXuLdvBZKuXofw\IFMb39aGmCsqJcthXwNQEToq7.exe"C:\ProgramData\4vFAHkNczECIXuLdvBZKuXofw\IFMb39aGmCsqJcthXwNQEToq7.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD844.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 63⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
645.3MB
MD50e730ffebb34f3c232c640174ff7f9b6
SHA190ac388d5c502999da0c2cc5f82281f7519adce2
SHA256ae6b5c03dadd619b590f53d1495697cd85fa3351cdb4a0e353696ff85d0bbc35
SHA5126beaab45ef6564d8cd6d6a678079a35a7bdfc334659bff6c2f296c794d96c9440cb47288548cf1b89c78e0463ac40dd11d90e168ae643c9557c61dc72fe27096
-
Filesize
645.3MB
MD50e730ffebb34f3c232c640174ff7f9b6
SHA190ac388d5c502999da0c2cc5f82281f7519adce2
SHA256ae6b5c03dadd619b590f53d1495697cd85fa3351cdb4a0e353696ff85d0bbc35
SHA5126beaab45ef6564d8cd6d6a678079a35a7bdfc334659bff6c2f296c794d96c9440cb47288548cf1b89c78e0463ac40dd11d90e168ae643c9557c61dc72fe27096
-
Filesize
184B
MD5cfeca88ff32d95ddceaf3b80ffdf55c9
SHA1d0c9d6c26476cc3eb927c4551406651223240f0d
SHA2569b593cf5219ce17863022d77869a11a59286059dc4538457562eb2410031e257
SHA51225a362d6689d70eec0e20dad7ea24a4b876b3ecd3c224001d893e2815d1249c0f9066f3f09e5a95276d33db0b4174ff5e077197d3f443df0b0a1ab9e3c03550d
-
Filesize
824KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
20KB