Analysis

  • max time kernel
    158s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2022 07:27

General

  • Target

    e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe

  • Size

    244KB

  • MD5

    2f3421d7257c9408476def4b6992346a

  • SHA1

    baa4ab526fa50bd895e732ecff1362ae1491d6f6

  • SHA256

    e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3

  • SHA512

    495d1ced30c6d4ba961d60df4c0036cf03eb0e6a7872736c5315a0070968536fb5a945575a3fdff1c01186c69232f8b938c4398a86bb4acd41b88ca696f9db2f

  • SSDEEP

    6144:djiQ+u5HAPkbZePJDmlI/+dfkIOwgccXYJcmI3cvHQOFZayUa/nM21:piQ+u5HAPk9EUoYJcmym0K

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 51 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe
    "C:\Users\Admin\AppData\Local\Temp\e6cf18dac2d322f140a5c33699718f5a3158b1967e3e503d56cd0565d636bde3.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Users\Admin\poiyo.exe
      "C:\Users\Admin\poiyo.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:684

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\poiyo.exe

    Filesize

    244KB

    MD5

    60cbd64e825004e1c222774db091dd05

    SHA1

    84cc763b2300653443c55e09f582a0e1a1c8fe18

    SHA256

    a65f83d89cbcada4b7660454bf66695964ba53b418240ad40001173ce0a2d1da

    SHA512

    2b2da8ae4134990b8e21b83a644309a1d6cafff2a22f25ba1fe8300a6d7aca6c1b4093cb8560d9a47f42f0116460b5d044c38037690cd28699fa44019dd4a2d6

  • C:\Users\Admin\poiyo.exe

    Filesize

    244KB

    MD5

    60cbd64e825004e1c222774db091dd05

    SHA1

    84cc763b2300653443c55e09f582a0e1a1c8fe18

    SHA256

    a65f83d89cbcada4b7660454bf66695964ba53b418240ad40001173ce0a2d1da

    SHA512

    2b2da8ae4134990b8e21b83a644309a1d6cafff2a22f25ba1fe8300a6d7aca6c1b4093cb8560d9a47f42f0116460b5d044c38037690cd28699fa44019dd4a2d6

  • memory/684-134-0x0000000000000000-mapping.dmp