Analysis
-
max time kernel
91s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 22:38
General
-
Target
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe
-
Size
1.2MB
-
MD5
da02266f9b13ebae7a39d285ec681a84
-
SHA1
93c2b86b4411c97960a02d53f5221fdbd44b0a47
-
SHA256
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84
-
SHA512
fbc6f710d921694855aaf7a22c38c81ef4f74441c85ce261e85cafe5021497adb738c3ff3a8b1a04ae583ff8d9f9d2e00842680798a1d63dd85cd7fce8fecea4
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
UPX packed file 40 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe"C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe"1⤵
- Checks computer location settings
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe"C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe" ÃüÁîÆô¶¯2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-328132.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport-328132.dll Bugreport %E8%AF%84%E8%AE%BA%E7%82%B9%203⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD526b22e9b633e2daa24920abf1de95bfa
SHA175c32d4ea46d55ef222df763b2d15d8e6b7fe06d
SHA2566a6e9e5de20f791233771a9a365c0432bc5da05021d81a2d4994659d86508d59
SHA51244087d6f545fe1a3c634b485ae12c7f8fe273cec92d53915064d169c7e3943a9d147d7976ff186a74307a57356270f550381cdb87c9cce2bcbc79128812d7adb
-
Filesize
1.2MB
MD526b22e9b633e2daa24920abf1de95bfa
SHA175c32d4ea46d55ef222df763b2d15d8e6b7fe06d
SHA2566a6e9e5de20f791233771a9a365c0432bc5da05021d81a2d4994659d86508d59
SHA51244087d6f545fe1a3c634b485ae12c7f8fe273cec92d53915064d169c7e3943a9d147d7976ff186a74307a57356270f550381cdb87c9cce2bcbc79128812d7adb
-
Filesize
164KB
MD5f0c0cd672a9505562f7ec727819c4867
SHA1b10d3556839c6ca26728b621383ec1624fe84489
SHA25628408ca1e4131fbf38a21b7d34c5aa52d8787d619dfaa552e1d2f886b2176457
SHA5128e3e82f8d53eb9ed26779d1ef43e38938c16255c103ef46c4a66cf300007def6146ed0b600a19dcdf27bc13368816ad47bf3e818d7da51ab141050f67d74746b
-
Filesize
164KB
MD5f0c0cd672a9505562f7ec727819c4867
SHA1b10d3556839c6ca26728b621383ec1624fe84489
SHA25628408ca1e4131fbf38a21b7d34c5aa52d8787d619dfaa552e1d2f886b2176457
SHA5128e3e82f8d53eb9ed26779d1ef43e38938c16255c103ef46c4a66cf300007def6146ed0b600a19dcdf27bc13368816ad47bf3e818d7da51ab141050f67d74746b
-
Filesize
81B
MD5bf0aa65977e52e278da721d998aca638
SHA196b55bdd93ba157b07be7da187a9388d5823da21
SHA25663a82471262255e032ca59edc9939994aadafdc2f0092dde45b780a4aff5d9cd
SHA512b7b00ed01ba1dbb02bcdec7863afc9edc7a19141ffbf036cf5935215920830b98167b8eb5677cf43efecb9b9c0ec3f451d3c9139daf58c591b3156c690c13292
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
-
Filesize
224KB