Analysis
-
max time kernel
90s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 22:14
General
-
Target
81c452de78c83531b2ef905b6d15d12f796e02265f823151b29407d7e14a340f.exe
-
Size
1.3MB
-
MD5
0fadc09ff72014be0b6b54239226d438
-
SHA1
f21a0d5a67973ee2340f64c1bad7f84cf98911f2
-
SHA256
81c452de78c83531b2ef905b6d15d12f796e02265f823151b29407d7e14a340f
-
SHA512
83283ba9cdc17255f6a6d6087ec7baa3133977c237bd188d733d3a18d29c2dc37540dd32baf0ebbe1453485b218a1c887fc92f693dddeaf33b217af870427171
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
UPX packed file 40 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81c452de78c83531b2ef905b6d15d12f796e02265f823151b29407d7e14a340f.exe"C:\Users\Admin\AppData\Local\Temp\81c452de78c83531b2ef905b6d15d12f796e02265f823151b29407d7e14a340f.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\81c452de78c83531b2ef905b6d15d12f796e02265f823151b29407d7e14a340f.exe"C:\Users\Admin\AppData\Local\Temp\81c452de78c83531b2ef905b6d15d12f796e02265f823151b29407d7e14a340f.exe" ÃüÁîÆô¶¯2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-393300.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport-393300.dll Bugreport %E8%AF%84%E8%AE%BA%E7%82%B9%203⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD591d93485c9eda71042ae993a91235920
SHA1b221362245697eb2725df006a69e26dcb23a03dd
SHA256a47cce7ec0c279b63775d7ea8a490c64ef4ce3fc91035a629687b4a0a3d77f3e
SHA512b51c3d2b75a78411867d02e927471e4ae481aae7f1c94083667d78066b5443432b6d52d3cd421873b8036f346643807020af9dbad15260a69c9b8687ffc85a90
-
Filesize
1.2MB
MD591d93485c9eda71042ae993a91235920
SHA1b221362245697eb2725df006a69e26dcb23a03dd
SHA256a47cce7ec0c279b63775d7ea8a490c64ef4ce3fc91035a629687b4a0a3d77f3e
SHA512b51c3d2b75a78411867d02e927471e4ae481aae7f1c94083667d78066b5443432b6d52d3cd421873b8036f346643807020af9dbad15260a69c9b8687ffc85a90
-
Filesize
164KB
MD54e6939c151b2c5924e84c9927edcdbd5
SHA134fc9b985b0a83a190cc1bee944f3d93fb4123cb
SHA2566d57bf57eb05a5fbcc4b1fd47d25a55a2680a2f36a06fc39891707746a086f73
SHA5127e19d703a397bf678ff3f90c40e6f9e858fb8cd791e00c08d27614ad3469856b13d71a6635fe70dba0616a3a14b5d06578ac0c1eac7b77c670bdf26a51459eb6
-
Filesize
164KB
MD54e6939c151b2c5924e84c9927edcdbd5
SHA134fc9b985b0a83a190cc1bee944f3d93fb4123cb
SHA2566d57bf57eb05a5fbcc4b1fd47d25a55a2680a2f36a06fc39891707746a086f73
SHA5127e19d703a397bf678ff3f90c40e6f9e858fb8cd791e00c08d27614ad3469856b13d71a6635fe70dba0616a3a14b5d06578ac0c1eac7b77c670bdf26a51459eb6
-
Filesize
81B
MD540d17cdc5ceb49ee8c39fad3b716d0b7
SHA1952746e3feae9b1333caba6ac506c3ff7659adbd
SHA25672998704cdac2a9c660b0004a8a9c1ee3d742f927020d07b45bd8c2dbbcd9e19
SHA5125523087e6f52c93970a06afc47d99ab86f50e6a6f5474905df2dc4f787c944b48a67cd62eb4ae7409e41e6821f766d1888b0e4380a3410581ce231244ec3f229
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
456KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
456KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
456KB
-
-
Filesize
252KB
-
Filesize
252KB
-
-
Filesize
224KB