Analysis
-
max time kernel
188s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
20-10-2022 11:31
General
-
Target
9ce2381590c3096b7d6eba0cbd100b9d37097a89c95d87027398662b863af414.exe
-
Size
42KB
-
MD5
9601004aa8ff3878128edbdf014fa699
-
SHA1
d35aa3a612ae9e3dc57daaa6a452f44cf642e62d
-
SHA256
9ce2381590c3096b7d6eba0cbd100b9d37097a89c95d87027398662b863af414
-
SHA512
8dab3f8bd706e9c20272f22c947bb63a3df342fd5df61227d3ee2842f22526686d69f5d3debb4f5967a16427fe9b6e8b18c24c95416476b6f8c801b48d556468
-
SSDEEP
768:gSz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D88888888882:BzOCay4wV339rPjzbpLwRJ9pSdoIb
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
-
ASPack v2.12-2.42 18 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 12 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 29 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 20 IoCs
-
Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ce2381590c3096b7d6eba0cbd100b9d37097a89c95d87027398662b863af414.exe"C:\Users\Admin\AppData\Local\Temp\9ce2381590c3096b7d6eba0cbd100b9d37097a89c95d87027398662b863af414.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9ce2381590c3096b7d6eba0cbd100b9d37097a89c95d87027398662b863af414.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD59915c23beb6b4fb1e8ab3739d410a160
SHA14103f077144655bf2e73e1ce9fdce169eaacd3c1
SHA2564373efd03fa1a6b3b6b05a3434cced2fd78c43385c5d2371826f6406f2122a93
SHA5128c601a4e741b854d89ec87aac286aa4a3cc5bccb1079e8819bcd37e8316a07faac2f4dbf39d0f39868985619fba88e6de8fd9637996de094ad7a3c08b4234744
-
Filesize
42KB
MD59915c23beb6b4fb1e8ab3739d410a160
SHA14103f077144655bf2e73e1ce9fdce169eaacd3c1
SHA2564373efd03fa1a6b3b6b05a3434cced2fd78c43385c5d2371826f6406f2122a93
SHA5128c601a4e741b854d89ec87aac286aa4a3cc5bccb1079e8819bcd37e8316a07faac2f4dbf39d0f39868985619fba88e6de8fd9637996de094ad7a3c08b4234744
-
Filesize
42KB
MD59915c23beb6b4fb1e8ab3739d410a160
SHA14103f077144655bf2e73e1ce9fdce169eaacd3c1
SHA2564373efd03fa1a6b3b6b05a3434cced2fd78c43385c5d2371826f6406f2122a93
SHA5128c601a4e741b854d89ec87aac286aa4a3cc5bccb1079e8819bcd37e8316a07faac2f4dbf39d0f39868985619fba88e6de8fd9637996de094ad7a3c08b4234744
-
Filesize
42KB
MD59915c23beb6b4fb1e8ab3739d410a160
SHA14103f077144655bf2e73e1ce9fdce169eaacd3c1
SHA2564373efd03fa1a6b3b6b05a3434cced2fd78c43385c5d2371826f6406f2122a93
SHA5128c601a4e741b854d89ec87aac286aa4a3cc5bccb1079e8819bcd37e8316a07faac2f4dbf39d0f39868985619fba88e6de8fd9637996de094ad7a3c08b4234744
-
Filesize
42KB
MD5f0ad1920e425f735f5b12da012858bc6
SHA1e64bf1fd704a1b5cdd10995c648df22f733e8e9d
SHA25641803fdd17a8605b6681c617e2236d98f99ce6f753461368408870b27a5a9ecf
SHA51257bf6409a5bd548e50207426e43fcd0c47a4bb38ef04108de9df16c7e481a8a940ed602c623609c967a3a99e2f69043dd8deed86fa1ca3255dd9439023ba84b0
-
Filesize
42KB
MD5f0ad1920e425f735f5b12da012858bc6
SHA1e64bf1fd704a1b5cdd10995c648df22f733e8e9d
SHA25641803fdd17a8605b6681c617e2236d98f99ce6f753461368408870b27a5a9ecf
SHA51257bf6409a5bd548e50207426e43fcd0c47a4bb38ef04108de9df16c7e481a8a940ed602c623609c967a3a99e2f69043dd8deed86fa1ca3255dd9439023ba84b0
-
Filesize
42KB
MD5f0ad1920e425f735f5b12da012858bc6
SHA1e64bf1fd704a1b5cdd10995c648df22f733e8e9d
SHA25641803fdd17a8605b6681c617e2236d98f99ce6f753461368408870b27a5a9ecf
SHA51257bf6409a5bd548e50207426e43fcd0c47a4bb38ef04108de9df16c7e481a8a940ed602c623609c967a3a99e2f69043dd8deed86fa1ca3255dd9439023ba84b0
-
Filesize
42KB
MD5f0ad1920e425f735f5b12da012858bc6
SHA1e64bf1fd704a1b5cdd10995c648df22f733e8e9d
SHA25641803fdd17a8605b6681c617e2236d98f99ce6f753461368408870b27a5a9ecf
SHA51257bf6409a5bd548e50207426e43fcd0c47a4bb38ef04108de9df16c7e481a8a940ed602c623609c967a3a99e2f69043dd8deed86fa1ca3255dd9439023ba84b0
-
Filesize
42KB
MD56483cd0ccd953e91143b64f4daf08672
SHA1b81ef0fc1e33d58b39741099f598aaf7271d04e9
SHA25656437732745ed3e3159bdb8dd158877b2555581f11c5789c5abe2db6854aa5d4
SHA5127643bcc438485aeddd1f41c5576c372cc9ace9ebded821948bdbe90ca6c6a0fabdb9c399bcf511ba0aba8aaef504cc82f6a4c44d7ab0c3c443b65ccb8b35f121
-
Filesize
42KB
MD56483cd0ccd953e91143b64f4daf08672
SHA1b81ef0fc1e33d58b39741099f598aaf7271d04e9
SHA25656437732745ed3e3159bdb8dd158877b2555581f11c5789c5abe2db6854aa5d4
SHA5127643bcc438485aeddd1f41c5576c372cc9ace9ebded821948bdbe90ca6c6a0fabdb9c399bcf511ba0aba8aaef504cc82f6a4c44d7ab0c3c443b65ccb8b35f121
-
Filesize
42KB
MD56483cd0ccd953e91143b64f4daf08672
SHA1b81ef0fc1e33d58b39741099f598aaf7271d04e9
SHA25656437732745ed3e3159bdb8dd158877b2555581f11c5789c5abe2db6854aa5d4
SHA5127643bcc438485aeddd1f41c5576c372cc9ace9ebded821948bdbe90ca6c6a0fabdb9c399bcf511ba0aba8aaef504cc82f6a4c44d7ab0c3c443b65ccb8b35f121
-
Filesize
42KB
MD56483cd0ccd953e91143b64f4daf08672
SHA1b81ef0fc1e33d58b39741099f598aaf7271d04e9
SHA25656437732745ed3e3159bdb8dd158877b2555581f11c5789c5abe2db6854aa5d4
SHA5127643bcc438485aeddd1f41c5576c372cc9ace9ebded821948bdbe90ca6c6a0fabdb9c399bcf511ba0aba8aaef504cc82f6a4c44d7ab0c3c443b65ccb8b35f121
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
42KB
MD57f87b3ca4ee77cf0a1f723f984966900
SHA1a5f11e846ff14728560aebf0348ea4de6a67a420
SHA256ae7e2cad2c8d46f7fa35d139278357dd4fcd058b36c08e2c4f0c033c93b4fcde
SHA51208b1fb9ff60f798c5758ea7bcff4fd91be9a3b3794dda8d087282243fa9fa2fc7ae97c8ba2cf05b1240f64e5b5b969b0d7fcc953cb58bca19b5218ab77b21f4f
-
Filesize
42KB
MD5422733abb3c1e755cb258b38fa6cb886
SHA1ba31cb8d24e8c20303de7024c2dc25d1dd43eead
SHA25661d8e4e955f7201c836a3af562dcde1541ec5e2744515508b39ba4ba2b865b47
SHA51269a783153f692cd32b4028e012e13a2fb06b202145c4961cabd50a562d06fbed5952762f4daebfbb77316f2b5182c65660a507d0aa5cd4bdd9ceaccc903495b6
-
Filesize
42KB
MD5422733abb3c1e755cb258b38fa6cb886
SHA1ba31cb8d24e8c20303de7024c2dc25d1dd43eead
SHA25661d8e4e955f7201c836a3af562dcde1541ec5e2744515508b39ba4ba2b865b47
SHA51269a783153f692cd32b4028e012e13a2fb06b202145c4961cabd50a562d06fbed5952762f4daebfbb77316f2b5182c65660a507d0aa5cd4bdd9ceaccc903495b6
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
42KB
MD59915c23beb6b4fb1e8ab3739d410a160
SHA14103f077144655bf2e73e1ce9fdce169eaacd3c1
SHA2564373efd03fa1a6b3b6b05a3434cced2fd78c43385c5d2371826f6406f2122a93
SHA5128c601a4e741b854d89ec87aac286aa4a3cc5bccb1079e8819bcd37e8316a07faac2f4dbf39d0f39868985619fba88e6de8fd9637996de094ad7a3c08b4234744
-
Filesize
42KB
MD5f0ad1920e425f735f5b12da012858bc6
SHA1e64bf1fd704a1b5cdd10995c648df22f733e8e9d
SHA25641803fdd17a8605b6681c617e2236d98f99ce6f753461368408870b27a5a9ecf
SHA51257bf6409a5bd548e50207426e43fcd0c47a4bb38ef04108de9df16c7e481a8a940ed602c623609c967a3a99e2f69043dd8deed86fa1ca3255dd9439023ba84b0
-
Filesize
42KB
MD56483cd0ccd953e91143b64f4daf08672
SHA1b81ef0fc1e33d58b39741099f598aaf7271d04e9
SHA25656437732745ed3e3159bdb8dd158877b2555581f11c5789c5abe2db6854aa5d4
SHA5127643bcc438485aeddd1f41c5576c372cc9ace9ebded821948bdbe90ca6c6a0fabdb9c399bcf511ba0aba8aaef504cc82f6a4c44d7ab0c3c443b65ccb8b35f121
-
Filesize
104KB
-
-
Filesize
104KB
-
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
-
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
-
-
Filesize
104KB
-
Filesize
104KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
104KB
-
-
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
-
-
Filesize
104KB
-
Filesize
104KB
-
-
Filesize
104KB
-
Filesize
104KB