d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea

General

Target

d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
Size

483KB
MD5

308200ad64438b287e75b14a28921574
SHA1

3c4fc9ef7cb7f5071aafc98d0813cfc90b340f4d
SHA256

d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea
SHA512

f468078528259c47f5446b4d9f2d62dc1cf1e9d62529368370da4fc5d40b78bb0d13052f9bbac52b205f70c5ab1b812666d45a8ca4d7bda09c9116019a956aeb
SSDEEP

3072:FH4dwAyWpHceA64QqKevdp7KLPpUfp7UAaf2LkzT:Fo1V9qKe1hKLxUfpB2

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2436	0913001858.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
1036	d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe

C:\Users\Admin\AppData\Local\Temp\d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe
"C:\Users\Admin\AppData\Local\Temp\d5f2b5e9b5fe85c4b7884d4fad0e37b5a6023e73bd8e5baf61465b91b86ceeea.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1036
- C:\Users\Admin\AppData\Local\Temp\0913001858.exe
  "C:\Users\Admin\AppData\Local\Temp\0913001858.exe"
  2⤵
  - Executes dropped EXE
  PID:2436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0913001858.exe

Filesize
136KB

MD5
01827d5066ef0c7ee38a5284bd3b923b

SHA1
f18fb1203b270c035095ac0fdafb82c7ae9430e3

SHA256
eef5447e84a3e28c7caefb9b423e8575d8ea5de2df451f80fac055dd6678e19d

SHA512
40c175d41dc5767ebd50d99effa1486cb18b46e137d45b19c530cb0292a69c4e7e23fb05a6a9a98264e44334729a5aa2ed71990ec7a19bd9602c971e29ae9e4f

Download Submit

Analysis

Sharing