Overview

overview

10

Static

static

45625d2373...97.exe

windows7-x64

10

45625d2373...97.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-10-2022 02:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    45625d2373533ea35ab3f1c721049d09971dfee643db47b4e4d6c0460bf89497.exe

  • Size

    236KB

  • MD5

    7d45ffe13b0b85ad86dc5b1922abb05b

  • SHA1

    7c4156bef43cc5135ca80831a1115d5b46b03185

  • SHA256

    45625d2373533ea35ab3f1c721049d09971dfee643db47b4e4d6c0460bf89497

  • SHA512

    ceea7714dc1c97f15aed1cfb91a1bba3e4c22d339b35c87d1fe0f6e9f8b716588c4bbe1b81daff7b035e8ba5c5f10cd405c4260fe204ba8423c93eabb2b10b5b

  • SSDEEP

    3072:Y6VlhkVYyPzKvyMZeDT51B8u05WCyiHCUmqBxh:eXLYyMwDtf8u05WCyiHCQ

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 29 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45625d2373533ea35ab3f1c721049d09971dfee643db47b4e4d6c0460bf89497.exe
    "C:\Users\Admin\AppData\Local\Temp\45625d2373533ea35ab3f1c721049d09971dfee643db47b4e4d6c0460bf89497.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Users\Admin\gbrot.exe
      "C:\Users\Admin\gbrot.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:204

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\gbrot.exe
    Filesize

    236KB

    MD5

    e269273ba18ecd57f9a0f7538f991884

    SHA1

    bedae04441813d4cfa0e3f6691d3c6617167a1a9

    SHA256

    4bc55cf894aac73b53992df0fd382fe1920ade255677f30ae07d3ae883d870bf

    SHA512

    74c808e017ada7e4d8168e32a1be26eb707ac254b2f28e0dc16193506c35ad5786f01261866eaae9fac2908158ebf134934c7c9a167230ab854e1cbe1e2ea972

    Download Submit

  • C:\Users\Admin\gbrot.exe
    Filesize

    236KB

    MD5

    e269273ba18ecd57f9a0f7538f991884

    SHA1

    bedae04441813d4cfa0e3f6691d3c6617167a1a9

    SHA256

    4bc55cf894aac73b53992df0fd382fe1920ade255677f30ae07d3ae883d870bf

    SHA512

    74c808e017ada7e4d8168e32a1be26eb707ac254b2f28e0dc16193506c35ad5786f01261866eaae9fac2908158ebf134934c7c9a167230ab854e1cbe1e2ea972

    Download Submit