Analysis
-
max time kernel
89s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
03-10-2022 02:15
General
-
Target
e105c23e82b23eff3126ea0fbf0c8850fcd253b0dbfe4283ccc066b23ee638cd.exe
-
Size
194KB
-
MD5
00afdd8933d2197f45560071082c88ed
-
SHA1
3c10cb3f935eff1d823ea82ef2d9f3bdca8d293f
-
SHA256
e105c23e82b23eff3126ea0fbf0c8850fcd253b0dbfe4283ccc066b23ee638cd
-
SHA512
0ed3a23fed09c2a77c5b54ca5179f4cac38bd594793833fb2131d5038a41ed28832db1922283bba532fd10524b64947c1935b5632f186a6c22f88229078796b1
-
SSDEEP
3072:AzX4Fmy4utEZeIS4OrhWbrZ1zVIQoeZVya59w8dFarlwCXgI+RDa367OmJkGPLZf:f4xS4tbrKQoA3ow+2aaOFzb
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Control Panel 8 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e105c23e82b23eff3126ea0fbf0c8850fcd253b0dbfe4283ccc066b23ee638cd.exe"C:\Users\Admin\AppData\Local\Temp\e105c23e82b23eff3126ea0fbf0c8850fcd253b0dbfe4283ccc066b23ee638cd.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Checks processor information in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\.ttC20C.tmp.vbs"2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1002B
MD59df700c8f6fd43fac0a89aef04214bbd
SHA16ec8bc6d4041ccf19757757c0da6592469f71c57
SHA2569ab6f2c3cc3965cd05f81d859bdfac3b25a5e70178f61ea677d31987c4e142fd
SHA5128bbcd322f3998c0f7d81884737ca313c1353ac7e3899f168fc8d44eafbe064193353b8b16f92113288ff2102c47623b542861440c414b8acf36d75c4ad645d4d
-
Filesize
116KB
MD5b10a43b9044b488dc8c7d33b250cfebb
SHA150100ea46001cc84ec2047c2be142e8a44b94664
SHA2565f81ba145a4cf8afff3eeefc8f22b4c69dadcb3cce5ce63abcc54de3d04e3eb3
SHA51241f2539e0dd8405992f95ec3eeab166dd7d976f7e13b809d6706242f1aa5ccb6b2c92338caf155d43cff228f57da262a394804c602c1fd75652b0a0535c7b61c
-
Filesize
116KB
MD5b10a43b9044b488dc8c7d33b250cfebb
SHA150100ea46001cc84ec2047c2be142e8a44b94664
SHA2565f81ba145a4cf8afff3eeefc8f22b4c69dadcb3cce5ce63abcc54de3d04e3eb3
SHA51241f2539e0dd8405992f95ec3eeab166dd7d976f7e13b809d6706242f1aa5ccb6b2c92338caf155d43cff228f57da262a394804c602c1fd75652b0a0535c7b61c
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
872KB
-
Filesize
192KB
-
Filesize
872KB
-