a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6

General

Target

a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6.exe
Size

356KB
MD5

7bf7a3959ad1b024a2b22ccd5d4387a0
SHA1

34a0476e3339707a75c4b852c535a3177ad4da51
SHA256

a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6
SHA512

b254a0cdead57e7a28784ce402b4424f19a33c5ffe457d67ba35d174795f670257d124a9d0133d22107f1e287bc6635f8944bfdd5407b7477e436a9d68d7cf47
SSDEEP

6144:VTfq8aL+jyORFsyRw5nVgOrkTxPcv/BnAtTHIw2hPVd+t3kfWeIDvxH5wCK/VVRA:Vi83ayaHkTOHETHz2fm8RIjxZU/VVRXw

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

1.exe1.exe

pid process

1704 1.exe
260 1.exe

pid	process
1704	1.exe
260	1.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/260-142-0x0000000000400000-0x0000000000500000-memory.dmp	upx
behavioral2/memory/260-144-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/260-146-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1.exe

description pid process target process

PID 1704 set thread context of 260 1704 1.exe 1.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4560 260 WerFault.exe 1.exe

description	pid	process	target process
PID 1704 set thread context of 260	1704	1.exe	1.exe

pid	pid_target	process	target process
4560	260	WerFault.exe	1.exe

NTFS ADS 1 IoCs

Processes:

a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6.exe

description	ioc	process
File opened for modification	C:\Extracted\.L:x”QbŸV Ÿã5\G´;CK(P5M{'ŠÝÅ°Ïªt¦®£ H50cxl+ºå©Fb=½•8—[5÷\|>Y±úØðŸ+Ì"Î–„LÕþt¿K}ìÏÎl2‘ÙŽÈ~ß7ÐKtÆvàƒžÁò÷Ú;p´²ÁÙ=²ëc÷³µ‰ªµ–1!„* 0Mjˆ8ÁÉø{<Šd†ý>\¸YªŽI6…£ÙâdÇJf¹{°ÁøÐã¥¡GŒïMFá,Ì)ò“ê5béÖuÉÇÒ°ô[K ‘¼œ	a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1.exe

pid process

1704 1.exe

pid	process
1704	1.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6.exe1.exe

description	pid	process	target process
PID 5112 wrote to memory of 1704	5112	a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6.exe	1.exe
PID 5112 wrote to memory of 1704	5112	a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6.exe	1.exe
PID 5112 wrote to memory of 1704	5112	a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6.exe	1.exe
PID 1704 wrote to memory of 260	1704	1.exe	1.exe
PID 1704 wrote to memory of 260	1704	1.exe	1.exe
PID 1704 wrote to memory of 260	1704	1.exe	1.exe
PID 1704 wrote to memory of 260	1704	1.exe	1.exe
PID 1704 wrote to memory of 260	1704	1.exe	1.exe
PID 1704 wrote to memory of 260	1704	1.exe	1.exe
PID 1704 wrote to memory of 260	1704	1.exe	1.exe
PID 1704 wrote to memory of 260	1704	1.exe	1.exe

C:\Users\Admin\AppData\Local\Temp\a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6.exe
"C:\Users\Admin\AppData\Local\Temp\a863503b3ade528eb3985046b4b9b324528eea8bed9a22569c0ba3b5189e0dd6.exe"
1⤵
- Checks computer location settings
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:5112

C:\Extracted\1.exe
"C:\Extracted\1.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704

C:\Extracted\1.exe
"C:\Extracted\1.exe"
3⤵
- Executes dropped EXE
PID:260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 260 -s 452
4⤵
- Program crash
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 260 -ip 260
1⤵
PID:1464

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Extracted\1.exe
Filesize
303KB

MD5
f6e6fcab82bab9eaa5521a07bb5c3713

SHA1
fdf70d41897ee5d8e62993c2b1300e1743483262

SHA256
5453da881f5383035d5c3ed4ab4e4aaad5bf1ed2bfdd960cf5ac0db9fc02d38d

SHA512
a8457c866d9ce246d2569fceddbd1c29ade3973262e84805093315adb9ed621ce339c0846d0d3a461a1f910de9c9b92806645546a52b02dd9f072b65151145ae

Download Submit
C:\Extracted\1.exe
Filesize
303KB

MD5
f6e6fcab82bab9eaa5521a07bb5c3713

SHA1
fdf70d41897ee5d8e62993c2b1300e1743483262

SHA256
5453da881f5383035d5c3ed4ab4e4aaad5bf1ed2bfdd960cf5ac0db9fc02d38d

SHA512
a8457c866d9ce246d2569fceddbd1c29ade3973262e84805093315adb9ed621ce339c0846d0d3a461a1f910de9c9b92806645546a52b02dd9f072b65151145ae

Download Submit
C:\Extracted\1.exe
Filesize
303KB

MD5
f6e6fcab82bab9eaa5521a07bb5c3713

SHA1
fdf70d41897ee5d8e62993c2b1300e1743483262

SHA256
5453da881f5383035d5c3ed4ab4e4aaad5bf1ed2bfdd960cf5ac0db9fc02d38d

SHA512
a8457c866d9ce246d2569fceddbd1c29ade3973262e84805093315adb9ed621ce339c0846d0d3a461a1f910de9c9b92806645546a52b02dd9f072b65151145ae

Download Submit
memory/260-141-0x0000000000000000-mapping.dmp

Download
memory/260-146-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/260-144-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/260-142-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/1704-135-0x0000000000000000-mapping.dmp

Download
memory/1704-138-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1704-145-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5112-132-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5112-134-0x0000000000030000-0x0000000000033000-memory.dmp

Filesize
12KB

Download
memory/5112-133-0x0000000000030000-0x0000000000033000-memory.dmp

Filesize
12KB

Download
memory/5112-147-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads