Analysis
-
max time kernel
111s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
23-11-2022 11:25
General
-
Target
69c5cda07427383dfd835e0e35061f5178093201a6709cc14fc36834fcd3b7ee.exe
-
Size
4.0MB
-
MD5
87dd9a924d5c984a2fb097202757c3eb
-
SHA1
66cd472f720f4f9b47fb8bebefdcbd62221c3be4
-
SHA256
69c5cda07427383dfd835e0e35061f5178093201a6709cc14fc36834fcd3b7ee
-
SHA512
20e1638338f838e146ccf9e44d1ac6df9b829fafb9cb2f73dde6177b82412ee09cacb402e21fa1769ac8517655c3aa5ca9f8d52668c6651736f48f762ba5782a
-
SSDEEP
98304:73S/a/VqVI0hME0Q4uDBB/U6Lx4BO8mCiSdKe5:zS/QwVIu4uDHh4BO1CBdh5
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 35 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c5cda07427383dfd835e0e35061f5178093201a6709cc14fc36834fcd3b7ee.exe"C:\Users\Admin\AppData\Local\Temp\69c5cda07427383dfd835e0e35061f5178093201a6709cc14fc36834fcd3b7ee.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\optprosetup.exeC:\Users\Admin\AppData\Local\Temp\\optprosetup.exe /VERYSILENT2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VG60Q.tmp\optprosetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-VG60Q.tmp\optprosetup.tmp" /SL5="$80056,3513242,85504,C:\Users\Admin\AppData\Local\Temp\optprosetup.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
645KB
MD54907726aac79f4de2c586ff7a00ed4a2
SHA13139d373051e57742ca7880d1997881ce45269d3
SHA2561f5fd63f7bff857d4c5925ec6b3f111ac0efd2cb72665439436177dd6a2e4d9d
SHA5122d25f45224cb46dd30ac7b97186486caeed2ae14fc92e6adf78fb003715f43d6e2cf969c2272791b84347bcaf4ff68e65ab519705c729220fe1b3181c640b9f6
-
Filesize
645KB
MD54907726aac79f4de2c586ff7a00ed4a2
SHA13139d373051e57742ca7880d1997881ce45269d3
SHA2561f5fd63f7bff857d4c5925ec6b3f111ac0efd2cb72665439436177dd6a2e4d9d
SHA5122d25f45224cb46dd30ac7b97186486caeed2ae14fc92e6adf78fb003715f43d6e2cf969c2272791b84347bcaf4ff68e65ab519705c729220fe1b3181c640b9f6
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
1.1MB
MD5ef7f8bae72830ceaf53ad9b8425534ca
SHA1c863cf8a9bbbbc46b6b64ce184c999d06ce5ced8
SHA256f4c0503beaa358e281b685c80ef4fe23b51c3dd5cbae4aa26da8c33d9f412766
SHA512a657ccf1197710a427e7e434634ca613156856fe27e5cd39f336a3e3c1e00c40cef164a332d8d2269a43bbd24a3c6d57c1ebff9c00386c24e0db9f072fe95a2a
-
Filesize
1.1MB
MD5ef7f8bae72830ceaf53ad9b8425534ca
SHA1c863cf8a9bbbbc46b6b64ce184c999d06ce5ced8
SHA256f4c0503beaa358e281b685c80ef4fe23b51c3dd5cbae4aa26da8c33d9f412766
SHA512a657ccf1197710a427e7e434634ca613156856fe27e5cd39f336a3e3c1e00c40cef164a332d8d2269a43bbd24a3c6d57c1ebff9c00386c24e0db9f072fe95a2a
-
Filesize
3.8MB
MD537bfa3862c28a623f8eb0e9fa5999c11
SHA1d89cf1b775c1f31b1981822187066d1360170a55
SHA2568c9baf760abcb505713dfe97d6ae13f1aee565deeb55ae30bbb773167c5a799a
SHA512c6fe6ace03713b6be3dd13898282fd5c0a8c9df11c8c6b57af1816524670ce3f34331f84e1a593558814f70bef72a0b0bce31a047a0ee3cf2758b2b4fc2aab6c
-
Filesize
3.8MB
MD537bfa3862c28a623f8eb0e9fa5999c11
SHA1d89cf1b775c1f31b1981822187066d1360170a55
SHA2568c9baf760abcb505713dfe97d6ae13f1aee565deeb55ae30bbb773167c5a799a
SHA512c6fe6ace03713b6be3dd13898282fd5c0a8c9df11c8c6b57af1816524670ce3f34331f84e1a593558814f70bef72a0b0bce31a047a0ee3cf2758b2b4fc2aab6c
-
-
Filesize
124KB
-
Filesize
124KB
-
-
Filesize
124KB
-
Filesize
240KB
-