6109e72c382692c62e32882b58056f0b57539536d18e82467aebaab230fe2516

Analysis

max time kernel
333s
max time network
325s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
30/10/2022, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

loaris-setup.exe
Size

1.1MB
MD5

3557cbd1876ca6e2665c5b5282e1a871
SHA1

9ea8435f4be459f3dc2eb5908ac8e54936f5298b
SHA256

6109e72c382692c62e32882b58056f0b57539536d18e82467aebaab230fe2516
SHA512

c2d74a0803f622b490f366072e8479adcb0b284a67b8be5c67c91cce2544033e3c82d535a8e1e99817a53ef71783d429749190b2852fe7c1109e06ddf39c4cb2
SSDEEP

24576:QEKqgMrl/srreblmDFEYRNCnLlL/W2DNct:GSl/srKluEoQpL/WYNct

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1272-132-0x0000000000400000-0x0000000000824000-memory.dmp	upx
behavioral2/memory/1272-133-0x0000000000400000-0x0000000000824000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2068	4832	WerFault.exe	67

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	loaris-setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	loaris-setup.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1272	loaris-setup.exe
1272	loaris-setup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1272	loaris-setup.exe

C:\Users\Admin\AppData\Local\Temp\loaris-setup.exe
"C:\Users\Admin\AppData\Local\Temp\loaris-setup.exe"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1272

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 4832 -ip 4832
1⤵
PID:2740

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4832 -s 772
1⤵
- Program crash
PID:2068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-132-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/1272-133-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download