Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
11/10/2022, 23:35
General
-
Target
f5034eb24cd8cdf06921e03fc3147f012199d7dc00ac4da39417be7bf02be50d.exe
-
Size
979KB
-
MD5
6b4fc3f65c734d92f7f09b0ea586e4a0
-
SHA1
b796e37b95d121c7079b2f31510d3967749dd0b1
-
SHA256
f5034eb24cd8cdf06921e03fc3147f012199d7dc00ac4da39417be7bf02be50d
-
SHA512
5819ca76e658ace9cd9408639f22c543b6cfc06580bbcf14c4d21ba44c0a8b1cbe12901379810a27cd87c577e5bae5582c45babfebb52c6b9ee22ef5a1707b8a
-
SSDEEP
24576:3NBIc3Nj/ptB57KoYnjQt7ZvwHXbKOxqhmy1E:Ag5RtBwDjStw3NoI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
VMProtect packed file 5 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 4 IoCs
-
Drops file in System32 directory 15 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5034eb24cd8cdf06921e03fc3147f012199d7dc00ac4da39417be7bf02be50d.exe"C:\Users\Admin\AppData\Local\Temp\f5034eb24cd8cdf06921e03fc3147f012199d7dc00ac4da39417be7bf02be50d.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XFilesHack\2.0\XFilesHack.exe"C:\Windows\system32\XFilesHack\2.0\XFilesHack.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
411KB
MD5e3c817f7fe44cc870ecdbcbc3ea36132
SHA12ada702a0c143a7ae39b7de16a4b5cc994d2548b
SHA256d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
SHA5124fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
-
Filesize
755KB
MD5bf38660a9125935658cfa3e53fdc7d65
SHA10b51fb415ec89848f339f8989d323bea722bfd70
SHA25660c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
SHA51225f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
-
Filesize
192KB
MD5165c8b03bd9d2e4ae6585ce5f6709e39
SHA1ab819340411b39d7270dead8f102986970b542ab
SHA25647ffebb38d417ed3b6226ace93842ee973af59b1e255a8b62acfdd9f4006d7fe
SHA512cec4e60853195921cc2bc0e2269c9cb50c702769c91d22d8ec476666eeac8b632c17a22c0d79022abfb5e3f7555e6d6cda0e4b94f656f7eb5882a3c6210affd8
-
Filesize
192KB
MD5165c8b03bd9d2e4ae6585ce5f6709e39
SHA1ab819340411b39d7270dead8f102986970b542ab
SHA25647ffebb38d417ed3b6226ace93842ee973af59b1e255a8b62acfdd9f4006d7fe
SHA512cec4e60853195921cc2bc0e2269c9cb50c702769c91d22d8ec476666eeac8b632c17a22c0d79022abfb5e3f7555e6d6cda0e4b94f656f7eb5882a3c6210affd8
-
Filesize
264KB
MD5d0f3b3aaa109a1ea8978c83d23055eb1
SHA1c975f714d414a259980b94f9bba67b2d680740de
SHA256433dc95e1f1c822033424c993c0a731edd12a0cdf0185a2efaa50da4515076b5
SHA5126283ba2aa068202a75025ea88f266fd2a34ea175f318cc017c70b61d5055765d60f91142baa538cc6aff206412a5c425a6a06cb1bfef9046eba29269f6e61883
-
Filesize
264KB
MD5d0f3b3aaa109a1ea8978c83d23055eb1
SHA1c975f714d414a259980b94f9bba67b2d680740de
SHA256433dc95e1f1c822033424c993c0a731edd12a0cdf0185a2efaa50da4515076b5
SHA5126283ba2aa068202a75025ea88f266fd2a34ea175f318cc017c70b61d5055765d60f91142baa538cc6aff206412a5c425a6a06cb1bfef9046eba29269f6e61883
-
Filesize
411KB
MD5e3c817f7fe44cc870ecdbcbc3ea36132
SHA12ada702a0c143a7ae39b7de16a4b5cc994d2548b
SHA256d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
SHA5124fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
-
Filesize
755KB
MD5bf38660a9125935658cfa3e53fdc7d65
SHA10b51fb415ec89848f339f8989d323bea722bfd70
SHA25660c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
SHA51225f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
-
Filesize
105KB
MD5b8a9e91134e7c89440a0f95470d5e47b
SHA13cbcee30fc0a7e9807931bc0dafceb627042bfc9
SHA25642967a768f341d9ce5174eb38a4d63754c3c41739e7d88f4e39cd7354c1fac71
SHA512e8583ea94b9d1321889359317e367abc88e90e96d0d9243258244a527ffa2b13ab97d0787693ca328960ceb934ea11eefd14abafd640a654473c26e420d2ec54
-
Filesize
105KB
MD5b8a9e91134e7c89440a0f95470d5e47b
SHA13cbcee30fc0a7e9807931bc0dafceb627042bfc9
SHA25642967a768f341d9ce5174eb38a4d63754c3c41739e7d88f4e39cd7354c1fac71
SHA512e8583ea94b9d1321889359317e367abc88e90e96d0d9243258244a527ffa2b13ab97d0787693ca328960ceb934ea11eefd14abafd640a654473c26e420d2ec54
-
Filesize
352KB
-
Filesize
352KB
-
Filesize
352KB