Overview

overview

8

Static

static

86267fab2e...1c.exe

windows7-x64

8

86267fab2e...1c.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 14:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe

  • Size

    167KB

  • MD5

    41ad48f02009727cfcc4c8ec129646d4

  • SHA1

    2d3fefacd4b7b6e6a74a30f9b1c28358d0eb31bf

  • SHA256

    86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c

  • SHA512

    09ab980707bed990d139ab673c893daa8469020ca0bf8d59c1d0f2975142c1df7301b10aef5d079506069969b0d33ea09a40bd07a2ce21e8a98e26681e66cf23

  • SSDEEP

    3072:AJSQuQ1QyQcQ+TT/T6EutTBfMkvDoHo6Uf1RD5bdu6y7F9bN2ocp7:oSbC9LjT/eEutTB/D6o6KDbdu6y7FlNY

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe
    "C:\Users\Admin\AppData\Local\Temp\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Users\Admin\AppData\Local\Temp\240545578\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe
      "C:\Users\Admin\AppData\Local\Temp\240545578\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:5056

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\240545578\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe
    Filesize

    250KB

    MD5

    bb370acf4de2e47ccd16040e7c24b29b

    SHA1

    07aad2b17174d202b79ca1fdee3c690e58899479

    SHA256

    acb4a13d42f6c075550f8d9ae467a6fd32b4c8fefcfc1fc80ee643d8b8c84289

    SHA512

    965966bcf706f0795f6c9f210524a01b8f1d64ee8d9da2f88b9cefd1eb25e13bb065e630edb06b436c8b0c2396158413dccb408b8a88f7449562123235fcba6f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\240545578\86267fab2eae4584710de2dfe6f6d84d0ae61f2beb9d3952e940b3d14876171c.exe
    Filesize

    250KB

    MD5

    bb370acf4de2e47ccd16040e7c24b29b

    SHA1

    07aad2b17174d202b79ca1fdee3c690e58899479

    SHA256

    acb4a13d42f6c075550f8d9ae467a6fd32b4c8fefcfc1fc80ee643d8b8c84289

    SHA512

    965966bcf706f0795f6c9f210524a01b8f1d64ee8d9da2f88b9cefd1eb25e13bb065e630edb06b436c8b0c2396158413dccb408b8a88f7449562123235fcba6f

    Download Submit