Analysis
-
max time kernel
67s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 23:33
General
-
Target
1876358d802ba9302a612ea85f1761bd3e885b4528e26a1f735617520bbc1c1f.exe
-
Size
4.9MB
-
MD5
cc23b55bb153f037f69c4d37df0f0b92
-
SHA1
60a5a0033f40380fab71d4af93601e431d157e01
-
SHA256
1876358d802ba9302a612ea85f1761bd3e885b4528e26a1f735617520bbc1c1f
-
SHA512
d56fd352e417e00a71d19f9a46b43398cf7640b59970759baf502a81e714a06f3d826a67982cd38200466d84962e1819c3f54208603578764b80b1626128f5e8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1876358d802ba9302a612ea85f1761bd3e885b4528e26a1f735617520bbc1c1f.exe"C:\Users\Admin\AppData\Local\Temp\1876358d802ba9302a612ea85f1761bd3e885b4528e26a1f735617520bbc1c1f.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\FutureXGame\Grand Theft Auto V Trainer.exe"C:\Users\Admin\FutureXGame\Grand Theft Auto V Trainer.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD5508a010138f2f34b7ce88e49ca63cfc3
SHA17a922683dc2fad141b19fe62ac0cae550bb411f6
SHA256b8f2ab2d9a6e88c7cc77164107d8136a37dddcd017a25c30c3cc12eb3ac993c7
SHA5129d75c0795a1c60cbd73f1a69265fea83ad098d3c46e11ea75d6d198c8b10b85bcb28ca64e90405fba3993388406fb576ce74a7e926d4608ad282f317af593dee
-
Filesize
3.3MB
MD5508a010138f2f34b7ce88e49ca63cfc3
SHA17a922683dc2fad141b19fe62ac0cae550bb411f6
SHA256b8f2ab2d9a6e88c7cc77164107d8136a37dddcd017a25c30c3cc12eb3ac993c7
SHA5129d75c0795a1c60cbd73f1a69265fea83ad098d3c46e11ea75d6d198c8b10b85bcb28ca64e90405fba3993388406fb576ce74a7e926d4608ad282f317af593dee
-
Filesize
181B
MD5f3fbb023d43cf38fc1e3721549869fc5
SHA135fdb32f765ef6ac1b635bec7b37670233932007
SHA2563169eaf554fbf9b3095dbb87c36f7fec461d3c8cd686cd374c661adcd98f4b62
SHA5121b880395c35a69f4edbe30c4c47123679497c31633d0d9f1d8cdb191e0d43b4cd456091af4cee6978dea75bb50a5aff4b11e6478c801004ea098ce9d63732ba0
-
Filesize
2.0MB
-
-
Filesize
5.8MB
-
Filesize
5.8MB
-
Filesize
10.8MB
-
Filesize
7.6MB
-
Filesize
10.8MB
-
Filesize
2.0MB
-
Filesize
6.9MB
-
Filesize
6.9MB