Analysis

  • max time kernel
    91s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-05-2022 22:38

General

  • Target

    999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe

  • Size

    1.2MB

  • MD5

    da02266f9b13ebae7a39d285ec681a84

  • SHA1

    93c2b86b4411c97960a02d53f5221fdbd44b0a47

  • SHA256

    999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84

  • SHA512

    fbc6f710d921694855aaf7a22c38c81ef4f74441c85ce261e85cafe5021497adb738c3ff3a8b1a04ae583ff8d9f9d2e00842680798a1d63dd85cd7fce8fecea4

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • UPX packed file 40 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe
    "C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe"
    1⤵
    • Checks computer location settings
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe
      "C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe" ÃüÁîÆô¶¯
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3356
      • C:\Users\Admin\AppData\Local\Temp\data\Bugreport-328132.dll
        C:\Users\Admin\AppData\Local\Temp\data\Bugreport-328132.dll Bugreport %E8%AF%84%E8%AE%BA%E7%82%B9%20
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4256

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe

    Filesize

    1.2MB

    MD5

    26b22e9b633e2daa24920abf1de95bfa

    SHA1

    75c32d4ea46d55ef222df763b2d15d8e6b7fe06d

    SHA256

    6a6e9e5de20f791233771a9a365c0432bc5da05021d81a2d4994659d86508d59

    SHA512

    44087d6f545fe1a3c634b485ae12c7f8fe273cec92d53915064d169c7e3943a9d147d7976ff186a74307a57356270f550381cdb87c9cce2bcbc79128812d7adb

  • C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe

    Filesize

    1.2MB

    MD5

    26b22e9b633e2daa24920abf1de95bfa

    SHA1

    75c32d4ea46d55ef222df763b2d15d8e6b7fe06d

    SHA256

    6a6e9e5de20f791233771a9a365c0432bc5da05021d81a2d4994659d86508d59

    SHA512

    44087d6f545fe1a3c634b485ae12c7f8fe273cec92d53915064d169c7e3943a9d147d7976ff186a74307a57356270f550381cdb87c9cce2bcbc79128812d7adb

  • C:\Users\Admin\AppData\Local\Temp\data\Bugreport-328132.dll

    Filesize

    164KB

    MD5

    f0c0cd672a9505562f7ec727819c4867

    SHA1

    b10d3556839c6ca26728b621383ec1624fe84489

    SHA256

    28408ca1e4131fbf38a21b7d34c5aa52d8787d619dfaa552e1d2f886b2176457

    SHA512

    8e3e82f8d53eb9ed26779d1ef43e38938c16255c103ef46c4a66cf300007def6146ed0b600a19dcdf27bc13368816ad47bf3e818d7da51ab141050f67d74746b

  • C:\Users\Admin\AppData\Local\Temp\data\Bugreport-328132.dll

    Filesize

    164KB

    MD5

    f0c0cd672a9505562f7ec727819c4867

    SHA1

    b10d3556839c6ca26728b621383ec1624fe84489

    SHA256

    28408ca1e4131fbf38a21b7d34c5aa52d8787d619dfaa552e1d2f886b2176457

    SHA512

    8e3e82f8d53eb9ed26779d1ef43e38938c16255c103ef46c4a66cf300007def6146ed0b600a19dcdf27bc13368816ad47bf3e818d7da51ab141050f67d74746b

  • C:\Users\Admin\AppData\Local\Temp\data\Bugreport.ini

    Filesize

    81B

    MD5

    bf0aa65977e52e278da721d998aca638

    SHA1

    96b55bdd93ba157b07be7da187a9388d5823da21

    SHA256

    63a82471262255e032ca59edc9939994aadafdc2f0092dde45b780a4aff5d9cd

    SHA512

    b7b00ed01ba1dbb02bcdec7863afc9edc7a19141ffbf036cf5935215920830b98167b8eb5677cf43efecb9b9c0ec3f451d3c9139daf58c591b3156c690c13292

  • memory/3356-193-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-185-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-195-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-176-0x0000000000000000-mapping.dmp

  • memory/3356-191-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-189-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-187-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-197-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-183-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-181-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-223-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-180-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-178-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/3356-224-0x00000000026F0000-0x0000000002762000-memory.dmp

    Filesize

    456KB

  • memory/3872-149-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-151-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-169-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-171-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-173-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-175-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-165-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-163-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-161-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-159-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-157-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-155-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-153-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-167-0x0000000002800000-0x0000000002872000-memory.dmp

    Filesize

    456KB

  • memory/3872-130-0x0000000002800000-0x0000000002872000-memory.dmp

    Filesize

    456KB

  • memory/3872-147-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-145-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-143-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-141-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-139-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-137-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-135-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-131-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-133-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/3872-132-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4256-225-0x0000000000000000-mapping.dmp

  • memory/4256-229-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB