Analysis
-
max time kernel
151s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:19
General
-
Target
LUSA TEX ORDER 07282020 .exe
-
Size
1.3MB
-
MD5
cbd2e0a042f3734b1b72543b3a55bd99
-
SHA1
e6b6ffe43795d6a4c6b3c60e1dbfe6b2d29333c6
-
SHA256
044c48fe42178958d8f55e5404e056ff0f1071d865deda9cc42518ab2c87fda7
-
SHA512
17a7f971ec908a19d0a0c8b9611caf7b0b3148a84723b3cf4d25d0a65b1a45341998a51286ad1dee31c9183010171311d4dd8c53ec603bfba61e37caedd8d10c
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LUSA TEX ORDER 07282020 .exe"C:\Users\Admin\AppData\Local\Temp\LUSA TEX ORDER 07282020 .exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF567.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\LUSA TEX ORDER 07282020 .exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ab15c7fe3dc23f51a8ed4545eb54a9cb
SHA1206a5e711a5b8819deae10c568fa760a23d9308c
SHA2562889f7b15e75b474bfa37c720f216861f138e8e39e1d2f807ce751a21086674b
SHA51229b8f09dfa625fad63d6cae0fd9d9f9ea19a4b5a001138c5afb644c0d37f1cc2e7bf51a4242af433568b22b19613b1570a234474663cc659dd4ad54c7407a114
-
Filesize
8KB
-
Filesize
32KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
1.3MB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
480KB
-
Filesize
68KB
-