Analysis
-
max time kernel
91s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
18/10/2022, 00:10
General
-
Target
f1aa5e3db2ab83d0323f43f15ef5276ea5572fde4d908d45a5fefe1a973e15e6.exe
-
Size
2.7MB
-
MD5
16fd8ed65f0054abb521a19d1415783c
-
SHA1
0a381bb3842d7f832c60b79569960569c55ebfce
-
SHA256
f1aa5e3db2ab83d0323f43f15ef5276ea5572fde4d908d45a5fefe1a973e15e6
-
SHA512
97210f5054a6b29370df5cba17012c0e5ac3e34e5410ff00d0ffbe83922c740e87d6838f4cd3df1ff9f4a3a1efdec235fc27453b07ab1a4453391a8d0a1e1cbb
-
SSDEEP
49152:zU+7PRxTgsXFDcOOyAqF6Y9reyrciht73ksxdNzRIRGrX46Ctyf:zUKpxTzDcLyAq/9reyrDjDkUd7Mc46Co
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 3 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Executes dropped EXE 5 IoCs
-
Registers COM server for autorun 1 TTPs 64 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1aa5e3db2ab83d0323f43f15ef5276ea5572fde4d908d45a5fefe1a973e15e6.exe"C:\Users\Admin\AppData\Local\Temp\f1aa5e3db2ab83d0323f43f15ef5276ea5572fde4d908d45a5fefe1a973e15e6.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\t9n63ud5fZjMHng.exeC:\Users\Admin\AppData\Local\Temp\t9n63ud5fZjMHng.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode4⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Checks computer location settings
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
529KB
MD5913e7ffb9281e6793b7d1395570e1603
SHA1a7b366a570cf1dd54c059024c12a29fe5b1a011a
SHA256f1a65a9a0aa5801283e925df7658efe9cecd8790c7f9b27b29341d37f7a5dcfa
SHA5120e675d101e1659b0a5cb26a12fc6555bdfe9ab184f4f2d0ad0844c4e6baba0da3d959f615886e9f3c0cf135e85dbcd2f5493e87a948cf9031b273d3243257020
-
Filesize
323KB
MD568b381dd5092d40c1c01cfee1ab3b0da
SHA12c4faec45ab301752fd0398af631085017c00401
SHA25660464e0a82df6f72b23797b6110fe08656c6377e3ab2e9e2c7ba5917992efee3
SHA5128aa5d5a8cee61a286a5d0dc182cfac9806cb385d8700cd4dc2c6b55db489d8ae674ff6dda788449f6333cdf5902e5188c33b5d20cd876078bc0a3629dc430fc4
-
Filesize
26.7MB
MD58286937cf91f209b557078ecfd047edb
SHA14c9a9de322ed6c7823d505d3f64e54bd517b6216
SHA25643f656f9aba52ddda1ecd62ef6358c2678cbb7602844254ac171cb346df4da9c
SHA51238b48d1e894c3e387c90c05224b9d49012c9a671b75e215eba0aaa8c8d698160db56ed7e2bc232154619d97ac0977ca2f234f46dac659a464a4650a3d16a0cf9
-
Filesize
553KB
MD557bd9bd545af2b0f2ce14a33ca57ece9
SHA115b4b5afff9abba2de64cbd4f0989f1b2fbc4bf1
SHA256a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf
SHA512d134f9881312ddbd0d61f39fd62af5443a4947d3de010fef3b0f6ebf17829bd4c2f13f6299d2a7aad35c868bb451ef6991c5093c2809e6be791f05f137324b39
-
Filesize
504KB
MD54ffef06099812f4f86d1280d69151a3f
SHA1e5da93b4e0cf14300701a0efbd7caf80b86621c3
SHA256d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3
SHA512d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a
-
Filesize
504KB
MD54ffef06099812f4f86d1280d69151a3f
SHA1e5da93b4e0cf14300701a0efbd7caf80b86621c3
SHA256d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3
SHA512d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a
-
Filesize
425KB
MD5ce8a66d40621f89c5a639691db3b96b4
SHA1b5f26f17ddd08e1ba73c57635c20c56aaa46b435
SHA256545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7
SHA51285fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671
-
Filesize
451KB
MD550ea1cd5e09e3e2002fadb02d67d8ce6
SHA1c4515f089a4615d920971b28833ec739e3c329f3
SHA256414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902
SHA512440ededc1389b253f3a31c4f188fda419daf2f58096cf73cad3e72a746bdcde6bde049ce74c1eb521909d700d50fbfddbf802ead190cd54927ea03b5d0ce81b3
-
Filesize
451KB
MD550ea1cd5e09e3e2002fadb02d67d8ce6
SHA1c4515f089a4615d920971b28833ec739e3c329f3
SHA256414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902
SHA512440ededc1389b253f3a31c4f188fda419daf2f58096cf73cad3e72a746bdcde6bde049ce74c1eb521909d700d50fbfddbf802ead190cd54927ea03b5d0ce81b3
-
Filesize
432KB
MD5037df27be847ef8ab259be13e98cdd59
SHA1d5541dfa2454a5d05c835ec5303c84628f48e7b2
SHA2569fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec
SHA5127e1a04368ec469e4059172c5b44fd08d4ea3d01df98bfd6d4cc91ac45f381862ecf89fe9c6bedce985a12158d840cd6cfa06ce9d22466fbf6110140465002205
-
Filesize
432KB
MD5037df27be847ef8ab259be13e98cdd59
SHA1d5541dfa2454a5d05c835ec5303c84628f48e7b2
SHA2569fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec
SHA5127e1a04368ec469e4059172c5b44fd08d4ea3d01df98bfd6d4cc91ac45f381862ecf89fe9c6bedce985a12158d840cd6cfa06ce9d22466fbf6110140465002205
-
Filesize
73KB
MD5cefcd5d1f068c4265c3976a4621543d4
SHA14d874d6d6fa19e0476a229917c01e7c1dd5ceacd
SHA256c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817
SHA512d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9
-
Filesize
425KB
MD5ce8a66d40621f89c5a639691db3b96b4
SHA1b5f26f17ddd08e1ba73c57635c20c56aaa46b435
SHA256545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7
SHA51285fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671
-
Filesize
73KB
MD5cefcd5d1f068c4265c3976a4621543d4
SHA14d874d6d6fa19e0476a229917c01e7c1dd5ceacd
SHA256c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817
SHA512d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9
-
Filesize
1.6MB
MD5950fd1e83d99ad018a885e1ecad53832
SHA1fabbbcb6b7cd233490e22bcf06297e039ff55495
SHA256e52f4f194f58c30f94cca0cff091b32f05f652e26fc478350a9d2d8165a2bb91
SHA51282dbf09c8c64f78a63b6a3e2de2ccfbb89ee26c02fe9acb0b48311e3370ba31dead9b01261c79482f414a8350da7229a7cd6d0d277f581fd3d38395f489e010f
-
Filesize
2.4MB
MD55ea3b132a7cdf572d1cfec6f9722c8b1
SHA1cc35027a9b787b61e116f2b0ecb261230aef684e
SHA2567298980bfdc19830bb374327a1d797515b0061e516cde98afe6687f49036150f
SHA51244003d18ea2ca4fae18d02f324f0acf753ae94ed858755ade634bbf4603b7941c222047308dc141ea6957d3d8f5bfd217a48aa1eabce0b0be75d4e33bbbaedfd
-
Filesize
40.2MB
MD5fb4aa59c92c9b3263eb07e07b91568b5
SHA16071a3e3c4338b90d892a8416b6a92fbfe25bb67
SHA256e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
SHA51260aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
-
Filesize
40.2MB
MD5fb4aa59c92c9b3263eb07e07b91568b5
SHA16071a3e3c4338b90d892a8416b6a92fbfe25bb67
SHA256e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
SHA51260aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
-
Filesize
40.2MB
MD5fb4aa59c92c9b3263eb07e07b91568b5
SHA16071a3e3c4338b90d892a8416b6a92fbfe25bb67
SHA256e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
SHA51260aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
-
Filesize
77B
MD57a963576e8b606a2b6c7cd1bc5397fe8
SHA13580395d1c338ef80ed4281f92fe1ded7cbc0408
SHA256839375de9fb2a5f2e405cd0b194900f293a1ae8be096eb345acc1e7a4ce9c72d
SHA5124c96d27eef0ee5507f077a8506ca9f723c2f10234711838b53409d5c3b0e10e48e0d9b45c47db45870146d50323faaa9507b9b2e9626be99020230abe29615ce
-
Filesize
2.7MB
MD53c83e5062435ebc70901ed6d86fc971f
SHA1d2ddfb82f684d6dbd1076f91e0efb05befd14374
SHA256b3cf84af7460f06f82e36c0df9579a354ad2a1ff3af68040a11943a8996f9212
SHA512ea445b2ef5c65a0c7b35048f6ae2c145972169315cd86eafc637a2b5733a98eec0a627d3575f99d10198931174b24da0a2d3aada950cc0a4ed1fdb1f54680f77
-
Filesize
71KB
MD5f60519a4b9abe303feb4b5b3666a551e
SHA1d5bb38474958a5f51fb74886482fa44e873898f5
SHA2566be608cffb5de883843e26f17b767ebf3e0a7fe41137460b32490bcec58e382d
SHA5123f5f479628de5e4c7911e3730062ac672f721cc513218f38193bfc9426f7fa988b97c9d315689f1b90f15805760b1b284fe4e5ef65fdf482014942f07b1e1bd7
-
Filesize
71KB
MD5f60519a4b9abe303feb4b5b3666a551e
SHA1d5bb38474958a5f51fb74886482fa44e873898f5
SHA2566be608cffb5de883843e26f17b767ebf3e0a7fe41137460b32490bcec58e382d
SHA5123f5f479628de5e4c7911e3730062ac672f721cc513218f38193bfc9426f7fa988b97c9d315689f1b90f15805760b1b284fe4e5ef65fdf482014942f07b1e1bd7