Analysis
-
max time kernel
155s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
18/10/2022, 23:50
General
-
Target
178babbbf127d9d56c35721fabb518f664593b959e6158bf61e54caa049d8dcf.exe
-
Size
598KB
-
MD5
23310b0361db04abd2b81d71fc300557
-
SHA1
2ebbd7cc1d018ef4872413d8c01f65c3b99914d1
-
SHA256
178babbbf127d9d56c35721fabb518f664593b959e6158bf61e54caa049d8dcf
-
SHA512
1a7e989003bfbb51381755d8089249e6c9478765b8ece9570113745e271131b4bf08d24d3d99a06895f5a3ad5d0a17434f78fe9afac322aa2c198b5b2b5cf7dc
-
SSDEEP
12288:tmLoLgmqLjKDzsMLYvNMy2RFQnyPve0gvJ2D:tmLoLgJLjKDzs9NMy2RFQnyPve0gxe
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\178babbbf127d9d56c35721fabb518f664593b959e6158bf61e54caa049d8dcf.exe"C:\Users\Admin\AppData\Local\Temp\178babbbf127d9d56c35721fabb518f664593b959e6158bf61e54caa049d8dcf.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Sysceamdvdkc.exe"C:\Users\Admin\AppData\Local\Temp\Sysceamdvdkc.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
598KB
MD5637e57112f302f0765d8611d35a29523
SHA119cd61bb253f6879c9c4d0cd279cbe3a256abb13
SHA256a8123eb6aad9af5aa751c0b2f4f13dbde8f8c405b374bd6db631b7046fc1470e
SHA51266f43722f0466190b33f1467c614a491024cac8fef311dbdfc08d1588c35be8ef7e2068f5707903a4d0bf8fe8eed7f2ec72b01321e59ffb95723ba420ec0bcdb
-
Filesize
598KB
MD5637e57112f302f0765d8611d35a29523
SHA119cd61bb253f6879c9c4d0cd279cbe3a256abb13
SHA256a8123eb6aad9af5aa751c0b2f4f13dbde8f8c405b374bd6db631b7046fc1470e
SHA51266f43722f0466190b33f1467c614a491024cac8fef311dbdfc08d1588c35be8ef7e2068f5707903a4d0bf8fe8eed7f2ec72b01321e59ffb95723ba420ec0bcdb
-
Filesize
102B
MD5c99a253e33d3075a257c57ef3e0391cc
SHA16a929c390e7a7cfa26ba18a08e35425442370997
SHA2562469677b945f589e6924c10dcfe3369ba08e03c360d0c33bbcb8f74c6b527c74
SHA512f38628b2795cac856e756b66a32634a549f71bf2eb4f3a851b82fd81bd3cf7c045d4971c43b988fc5478ae61f9b9483fba0bc4c57d03a0ad8c0ea56eebd356ab
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB