Analysis
-
max time kernel
154s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
19-10-2022 14:06
General
-
Target
e4973668c78665dc1dfc1bb38ffbcea69c6d051aaa84a81b719702962fc9940c.exe
-
Size
1.2MB
-
MD5
826cd86150d2f35611763b27accb2655
-
SHA1
b9fe9769f84454027870a5c55cd5da940930c3a7
-
SHA256
e4973668c78665dc1dfc1bb38ffbcea69c6d051aaa84a81b719702962fc9940c
-
SHA512
9d7e4e5dba523f9926dae639d4fa308a079484c74b39d95092801c36bce6c488b21092d12bb593e07d1c2fd6c81b14bd9ffa2080ed51a30a2ef0dfa893f8dee4
-
SSDEEP
24576:CNLivgmahF/BC77uoYXzLCdQZNPKjGRiIRovzay7kC99Urs6N:siYmahFW7uoYj2da18sLReLXw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4973668c78665dc1dfc1bb38ffbcea69c6d051aaa84a81b719702962fc9940c.exe"C:\Users\Admin\AppData\Local\Temp\e4973668c78665dc1dfc1bb38ffbcea69c6d051aaa84a81b719702962fc9940c.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9789195732344078.exe"C:\Users\Admin\AppData\Local\Temp\9789195732344078.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
499KB
MD5f344661d2abeef40bee5664e40531788
SHA1d6abebda5991fea5cd6b563f25834fa618f9698b
SHA2561999d4ab5e4634fa251ac9211868612d56dd6dccd944f768e03e3b2cca46e676
SHA51210a5a362de57a52abfa9aad3f26a448475ff55b4a0ed17b24b8eb87431bbd717c62148c89648c322e216826aeb4510ab7b92ec12b596409f62dff19bb08dbb19
-
Filesize
176KB
MD57fb2833d5e07c0038bab670e775ba68b
SHA1ece600a5a668131523651259c022c5b7108dc391
SHA256b30db99082e9483f40aa2df35749c26f3a846ba1002e57c57f73fb2959e97191
SHA512af13c92f76c984b9f834c7e8e14da1e3bb467ca93e3b7be831f5b9ff32b2d8e5069ba30b1196b58d16cfd1e8bfd98e4971e94df0e5a53ccef7d759aa6c1f9a08
-
Filesize
994KB
MD5d57e10a046da9f71b96ba9f4cd50c6cc
SHA1c78d989345a4175b19130a83b6643b93bc8e1148
SHA2568d3ee72543420f8049ada5f65e390052fad1a892a4101af815dbd2ee155aa028
SHA5126e8d4047fb6e106147f1672e40b6696347fe67ea5c832ad15ba36b01ce92f1fafa7953cf1b010c6003b42e7248fe39ea40309b0e9f1819a91009b6a409271e22
-
Filesize
994KB
MD5d57e10a046da9f71b96ba9f4cd50c6cc
SHA1c78d989345a4175b19130a83b6643b93bc8e1148
SHA2568d3ee72543420f8049ada5f65e390052fad1a892a4101af815dbd2ee155aa028
SHA5126e8d4047fb6e106147f1672e40b6696347fe67ea5c832ad15ba36b01ce92f1fafa7953cf1b010c6003b42e7248fe39ea40309b0e9f1819a91009b6a409271e22
-
-
Filesize
492KB