Overview

overview

8

Static

static

8

a05c3103af...ae.exe

windows7_x64

8

a05c3103af...ae.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    1553s
  • max time network
    1591s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05-07-2022 03:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a05c3103af9403cacc0883f830d01bf685d3bbefbfcc4a5e1e0d11b669f700ae.exe

  • Size

    1.5MB

  • MD5

    32b4d27b0195dcd6598237ed49fac8a2

  • SHA1

    5330a378cd0ac2053af7d44547011503db109c43

  • SHA256

    a05c3103af9403cacc0883f830d01bf685d3bbefbfcc4a5e1e0d11b669f700ae

  • SHA512

    d0b693249b792655e671700b749fabaa142fada42c05ff20bfd56650d626d48db5b9ee3c8a5b4c40818e7ee9f41aeab798b7b50aadfe69e4eb36b3be6c113ee2

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a05c3103af9403cacc0883f830d01bf685d3bbefbfcc4a5e1e0d11b669f700ae.exe
    "C:\Users\Admin\AppData\Local\Temp\a05c3103af9403cacc0883f830d01bf685d3bbefbfcc4a5e1e0d11b669f700ae.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
      "C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe" -install -54422427 -focus -92f73a28376942c19bfbf4399078ba3a - -landingpage -nijymqujdqzdelgx -4832
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4640

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
    Filesize

    539KB

    MD5

    1ccedf2f9dd02b8da1d5b25274469263

    SHA1

    c5f443284710bf1cd1f8345a1f4ed771912e1ecf

    SHA256

    160caa29711bc82b49468404b20fb1a1c72ebe79fdee6ab45d6a94e81819fe43

    SHA512

    748ac8ca6a4499f0f65b51e69762dc764b9f0eb5624994a8c4681cca46b0bba8b6b29c57424c1b87c2f7bdd41462852e69bc5cd9dee3cc5d765672627b4bd5d1

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\DMR\dmr_72.exe
    Filesize

    539KB

    MD5

    1ccedf2f9dd02b8da1d5b25274469263

    SHA1

    c5f443284710bf1cd1f8345a1f4ed771912e1ecf

    SHA256

    160caa29711bc82b49468404b20fb1a1c72ebe79fdee6ab45d6a94e81819fe43

    SHA512

    748ac8ca6a4499f0f65b51e69762dc764b9f0eb5624994a8c4681cca46b0bba8b6b29c57424c1b87c2f7bdd41462852e69bc5cd9dee3cc5d765672627b4bd5d1

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\DMR\nijymqujdqzdelgx.dat
    Filesize

    41B

    MD5

    b8e0c7514855c7b63e03769aa415b210

    SHA1

    71b39e2da36e077984bae4bca10e8869f5df8129

    SHA256

    71b08ef6d5eb7aeed0b9f8d839326f076e49803ebf8e1ec73543d74b171aa206

    SHA512

    6e8977e383b220d5a8dada5c111df1c04e6b0fe1747b564426b04850b4480e4a29f50c13f479b1d30d306e8e1e5aae32d43a73b5e3a5a5908c2482e28cb48b28

    Download Submit
  • memory/4640-131-0x0000000000000000-mapping.dmp
    Download
  • memory/4640-134-0x0000000000820000-0x00000000008AC000-memory.dmp
    Filesize

    560KB

    Download
  • memory/4640-135-0x00007FFAC74A0000-0x00007FFAC7F61000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/4640-138-0x00007FFAC74A0000-0x00007FFAC7F61000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/4640-139-0x00007FFAC74A0000-0x00007FFAC7F61000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/4832-130-0x0000000000CF0000-0x000000000100D000-memory.dmp
    Filesize

    3.1MB

    Download
  • memory/4832-137-0x0000000000CF0000-0x000000000100D000-memory.dmp
    Filesize

    3.1MB

    Download