Overview

overview

8

Static

static

c1a7f703ab...4e.exe

windows7-x64

8

c1a7f703ab...4e.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2022, 23:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe

  • Size

    512KB

  • MD5

    226adb34a3b1c76c418a4518f0aef462

  • SHA1

    3ee723ac8fd27153789b2750b99b853bb7d60526

  • SHA256

    c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e

  • SHA512

    f11b6710754276d333b4772260ba3f195ae85865ea19c9e70457d9295a9cf3810f47a61f355262dc271ef45ca9825c87105dcd9883b8501f60e523e050bc4ac6

  • SSDEEP

    12288:ARTO7KNDsJValqO+Ibz1Tx1YFDT4DQFu/U3buRKlemZ9DnGAer7k5PQIg7:AU8DQaEuNz9ef8

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe
    "C:\Users\Admin\AppData\Local\Temp\c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nssvc32.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nssvc32.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4716

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nssvc32.exe
    Filesize

    512KB

    MD5

    226adb34a3b1c76c418a4518f0aef462

    SHA1

    3ee723ac8fd27153789b2750b99b853bb7d60526

    SHA256

    c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e

    SHA512

    f11b6710754276d333b4772260ba3f195ae85865ea19c9e70457d9295a9cf3810f47a61f355262dc271ef45ca9825c87105dcd9883b8501f60e523e050bc4ac6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nssvc32.exe
    Filesize

    512KB

    MD5

    226adb34a3b1c76c418a4518f0aef462

    SHA1

    3ee723ac8fd27153789b2750b99b853bb7d60526

    SHA256

    c1a7f703abeae6cc6b24d708db0108d2959d99e63c3bea08736e71a67c895b4e

    SHA512

    f11b6710754276d333b4772260ba3f195ae85865ea19c9e70457d9295a9cf3810f47a61f355262dc271ef45ca9825c87105dcd9883b8501f60e523e050bc4ac6

    Download Submit