Analysis
-
max time kernel
155s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 15:33
Static task
static1
Behavioral task
behavioral1
Sample
3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe
-
Size
244KB
-
MD5
7d313a77247f85375dc38ed4aa1514da
-
SHA1
c54e4d53a330918b97dfc06ab18c832a0e38dc0e
-
SHA256
3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2
-
SHA512
64ecf3a9060eb0a429583b19f84f8dd2cfe975a9adcfc92bf3a416b68cb4a8bf85292ff826bde4223702c4b481970e2d0d067f65e52e66e9b593bb2247b30d0b
-
SSDEEP
3072:AhPBdCsROnFQn7/5yIuSP9lqVinU3bp/PTm2moJ6BwA+GABMndgSqDD:AhJdT/7PnqVinU3bw2moJ6WAdgBX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" laarea.exe -
Executes dropped EXE 1 IoCs
pid Process 5048 laarea.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /x" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /d" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /t" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /m" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /z" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /w" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /s" laarea.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /a" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /n" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /b" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /k" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /f" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /e" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /q" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /h" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /y" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /v" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /i" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /c" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /g" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /p" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /j" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /l" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /o" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /g" 3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /u" laarea.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laarea = "C:\\Users\\Admin\\laarea.exe /r" laarea.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1684 3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe 1684 3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe 5048 laarea.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1684 3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe 5048 laarea.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1684 wrote to memory of 5048 1684 3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe 83 PID 1684 wrote to memory of 5048 1684 3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe 83 PID 1684 wrote to memory of 5048 1684 3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe"C:\Users\Admin\AppData\Local\Temp\3878b676986c57646f825c9aa4b87d9ca8dd99a77034ce7f14d3940daae8eed2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\laarea.exe"C:\Users\Admin\laarea.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5048
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
MD5c1fc47fd07a6bbb404bff19dfed552b1
SHA1f350d35487d1ce0a5cae6997395624e7896768ff
SHA256edd6e9722d03edbfc5ca2dc56a44fe162b99aaedea07a04cb1097c9f46724096
SHA5129563a61d62d08e4d0ff4f2f1a4efa6d8d86198f51d2e597374aff51efa66f246b61738a3265c627a1e2e59d99f2fdfcdad62741a9fb7aa62a73dded21c908ea8
-
Filesize
244KB
MD5c1fc47fd07a6bbb404bff19dfed552b1
SHA1f350d35487d1ce0a5cae6997395624e7896768ff
SHA256edd6e9722d03edbfc5ca2dc56a44fe162b99aaedea07a04cb1097c9f46724096
SHA5129563a61d62d08e4d0ff4f2f1a4efa6d8d86198f51d2e597374aff51efa66f246b61738a3265c627a1e2e59d99f2fdfcdad62741a9fb7aa62a73dded21c908ea8