Analysis
-
max time kernel
11s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
16/10/2022, 20:35
General
-
Target
8dba90b3c3a6aa0910626ec52d76104895da7591f8b9e04a67392a179f67eb79.exe
-
Size
15KB
-
MD5
e1307845110562239b94640d08755fbf
-
SHA1
c6452c0d8a7138f37e1d97bd827c9f0da4a09582
-
SHA256
8dba90b3c3a6aa0910626ec52d76104895da7591f8b9e04a67392a179f67eb79
-
SHA512
b298a164acc14cd2a98861ae25005541c166955fdf02fa0ba1ddfcbac4592dd2e4be3df000d3ce23df99b50029c227295814ec26c65fcc47bbc640d99a7c52ee
-
SSDEEP
384:YXMRDbYNp5T83uXkao2mq+VANj3O8q3Ltln8ka+0PlRcli:l1bYNT83uXka+VANj+3xlnLP0PMl
Malware Config
Signatures
-
UAC bypass 3 TTPs 6 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dba90b3c3a6aa0910626ec52d76104895da7591f8b9e04a67392a179f67eb79.exe"C:\Users\Admin\AppData\Local\Temp\8dba90b3c3a6aa0910626ec52d76104895da7591f8b9e04a67392a179f67eb79.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8dba90b3c3a6aa0910626ec52d76104895da7591f8b9e04a67392a179f67eb79.exe"C:\Users\Admin\AppData\Local\Temp\8dba90b3c3a6aa0910626ec52d76104895da7591f8b9e04a67392a179f67eb79.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Public\Documents\k4.exeC:/Users/Public/Documents/k4.exe /D2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /t /im k4.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d476c88087a2ca24d7e4d4b03dd83992
SHA1e71ea8ca8a34fbc711593b156445717f77b0fb17
SHA256130d3f07cad864d90ca717b22da75f19fd4c712cabdbf1b511c591f1097af0b8
SHA5120ed1a276a4c0f2b9e6017d439e28c608d50cf8971c85954bf9b730815c478e2fec1c0368acc7f6f1f924d297c6242087b74093a23026ad836734ce311cafafca
-
Filesize
1.1MB
MD5d476c88087a2ca24d7e4d4b03dd83992
SHA1e71ea8ca8a34fbc711593b156445717f77b0fb17
SHA256130d3f07cad864d90ca717b22da75f19fd4c712cabdbf1b511c591f1097af0b8
SHA5120ed1a276a4c0f2b9e6017d439e28c608d50cf8971c85954bf9b730815c478e2fec1c0368acc7f6f1f924d297c6242087b74093a23026ad836734ce311cafafca
-
Filesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
Filesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
Filesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
Filesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
Filesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
Filesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
Filesize
64KB
-
Filesize
1.6MB
-
Filesize
1.4MB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
2.1MB
-
Filesize
1024KB
-
Filesize
488KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
488KB
-
Filesize
1.6MB
-
Filesize
2.1MB
-
Filesize
1.4MB
-
Filesize
1.6MB