Analysis

  • max time kernel
    142s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2022, 02:23

General

  • Target

    6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe

  • Size

    541KB

  • MD5

    2e16b595c485a97b2532b1c48417f367

  • SHA1

    090fddd8b2915936c934a9fd2407feac78d2962a

  • SHA256

    6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554

  • SHA512

    933356cd137bc4345eac1af4251affb823468ff3f2fdb250d7ce25170092af5ec44ab244cd19e4f94b5c11405bedb9c119d4237a6707cd9e090daa1820a05a34

  • SSDEEP

    12288:EDaq927uCSbyjNfh4NC/E5l2F+7p64ozoCeaUUo2VWh:EDz2yyjT4N+R+7IjeaUUo28h

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 46 IoCs
  • Runs regedit.exe 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe
    "C:\Users\Admin\AppData\Local\Temp\6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Windows\SysWOW64\regedit.exe
      regedit /s C:\Users\Admin\AppData\Local\Temp\$rar10656.tmp
      2⤵
      • Modifies registry class
      • Runs regedit.exe
      PID:4872
    • C:\Windows\SysWOW64\regedit.exe
      regedit /s C:\Users\Admin\AppData\Local\Temp\$10943.tmp
      2⤵
      • Runs regedit.exe
      PID:4936
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$edbs.bat
      2⤵
        PID:4884
      • C:\Windows\SysWOW64\regedit.exe
        C:\Windows\regedit.exe /s C:\Users\Admin\AppData\Local\Temp\okhhhik.tmp
        2⤵
        • Modifies registry class
        • Runs regedit.exe
        PID:4904
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$dmsf.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Windows\SysWOW64\reg.exe
          reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f
          3⤵
            PID:1808

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\$$dmsf.bat

        Filesize

        665B

        MD5

        d856f1fe03701148c3e9189c6210a00d

        SHA1

        95c0cc3185d0876e2ddcaead82393395f7fb0c13

        SHA256

        0fc53d795c1ce09989b29b8c9cf77367396890db047e1c2dff362962f98af5f3

        SHA512

        d42c3c1b8d7734e4ebca3513ddf9728e89be1dfb4c2b5591c9f7d0c9c9556bf2b0595e1797b3a51f205a151a20bbdd9a4365abb9f8aab87a7541da312fb03635

      • C:\Users\Admin\AppData\Local\Temp\$$edbs.bat

        Filesize

        59B

        MD5

        0cf180f20e716094bef34db0f1a39a04

        SHA1

        f8e9da5d8eaf347b240a77c6a9c4f494d4fc351b

        SHA256

        2a72298ec1d957d1d225aec50a4e6e32c5dec2f2645f25e580304e5c7ae5bb26

        SHA512

        a471fee35dfc685effb46fcc37d47d7210fad3fdba7cb5342b13e11f95ae7690e4053b3399bca6da7546015a479ce55a301c6934be8bab7ec9eae5aece8bdb3b

      • C:\Users\Admin\AppData\Local\Temp\$rar10656.tmp

        Filesize

        1KB

        MD5

        f9ce5c8a3059991babf4084151caa492

        SHA1

        26567f89a885b0e69f24309c3e5c58e8e938f841

        SHA256

        e82c214f33cad1b25146758e22fd887b15f63b1a7a8d716b358c50dc5c3d4e96

        SHA512

        cce48827588aa5968453a8a69baeab8435083dca1d625d079b01d4f9292c7bcb85ab1217f1cf96ea301eef49b7a96a76b58413d4496f1c35e234df7c7e5c9750

      • C:\Users\Admin\AppData\Local\Temp\$rar10943.tmp

        Filesize

        142B

        MD5

        1722b85f05faa97e09cc1d98002d0711

        SHA1

        0a2ec5d60f6c8af838fc004e8fbb0b436437887f

        SHA256

        2c428a167d8dabe9b4e4e821f5d56333962208ef44bc0becbf9c968f1e583e21

        SHA512

        40393e3b6f958a2b0303810ba3653f55b18ff22439df78487752c92cbe0a510120b2a078b31805980ae2ceaa4465674bfc2ce03803988481fd633e2b9c3ca3b8

      • C:\Users\Admin\AppData\Local\Temp\okhhhik.tmp

        Filesize

        4KB

        MD5

        e65d0630e7c3363eff81fd64109c3dac

        SHA1

        062d18f42ff35760bed198d51c1056a42c22bfba

        SHA256

        286db12cc30d8834f18cbc2d72aab3cbc8ab4c515dc8f4e124c82eaa61e4061d

        SHA512

        d4921c73729c5a00f9f2348d93cd0db827ea17cb45295f0f0b05d99597a241dab7703b674dd107e7a9d15854765b279af7d4f6b7ab8c44a1e658e361c63c0559

      • C:\Windows\RtkSYUdp.exe

        Filesize

        30KB

        MD5

        d0cd586c5c857850a188e778b971f25a

        SHA1

        3f584fd89e41151c389b4701d876d2bdd2885fc2

        SHA256

        2f6cd2ed9806a09fecce1f96cd5b3f77fc0339ddbbb4c31aab25e85fd3f268eb

        SHA512

        995f539c7163e0e49c7cc4687dd29dac4ac88501410d8c9935f99d993b14bf5fe349cdcdc9f61d4f308c280536b54f54ae7d041565c73a2340881f68e7b2c41c

      • memory/1188-142-0x0000000000400000-0x00000000004E7000-memory.dmp

        Filesize

        924KB

      • memory/1188-132-0x0000000000400000-0x00000000004E7000-memory.dmp

        Filesize

        924KB