Analysis
-
max time kernel
156s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 14:12
General
-
Target
5d65e415b3e985162f67ce079d1e55723818b05e3aacc6e85196dd1bed0576c6.exe
-
Size
622KB
-
MD5
8935e8c56a13bd974f94373f187fc00b
-
SHA1
ba4e69370f6954f87489508170ccf688aa323550
-
SHA256
5d65e415b3e985162f67ce079d1e55723818b05e3aacc6e85196dd1bed0576c6
-
SHA512
ff26ab5aba08f7188c442b5703260e2f651b207746a25b53443b41c9064680bba362664ea884bdfcb4ea2555750d688c00d1ae2952ef39f1b6a6d4a125aa8f34
-
SSDEEP
12288:AuiB6bin34Lj+4re24FPTa5f0Wn/gvp1wZ9sFnW9QOh/NNZcy:SB6cuerFMfT/T9sJW9V9Ky
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 4 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d65e415b3e985162f67ce079d1e55723818b05e3aacc6e85196dd1bed0576c6.exe"C:\Users\Admin\AppData\Local\Temp\5d65e415b3e985162f67ce079d1e55723818b05e3aacc6e85196dd1bed0576c6.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5d65e415b3e985162f67ce079d1e55723818b05e3aacc6e85196dd1bed0576c6.exe"C:\Users\Admin\AppData\Local\Temp\5d65e415b3e985162f67ce079d1e55723818b05e3aacc6e85196dd1bed0576c6.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /z "C:\Users\Admin\AppData\Local\Temp\5d65e415b3e985162f67ce079d1e55723818b05e3aacc6e85196dd1bed0576c6.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5d65e415b3e985162f67ce079d1e55723818b05e3aacc6e85196dd1bed0576c6.exe"3⤵
- Drops startup file
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 23803⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /z "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Adobe.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe.exe"5⤵
- Drops startup file
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 24725⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Dnscache.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5cd3f4e80399e67faf98eef162fac16cb
SHA128454f7c245c9f403e8f54ed2a3b0cab4fc82b13
SHA25672337532914d8decab0d41c91bb4fbd68e67dd70971258f3c1b998c45edae69b
SHA512f6c63ed0408e379dcb2c23d4cd7fd57ac340cb05b01cdac5a3c935a0f90c57953e4396780485e02f41f54ec6a1c8fc5cb4cd89b1ee3f5fc02e18f2f8f4a746d8
-
Filesize
128B
MD5a5dcc7c9c08af7dddd82be5b036a4416
SHA14f998ca1526d199e355ffb435bae111a2779b994
SHA256e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
SHA51256035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
-
Filesize
622KB
MD58935e8c56a13bd974f94373f187fc00b
SHA1ba4e69370f6954f87489508170ccf688aa323550
SHA2565d65e415b3e985162f67ce079d1e55723818b05e3aacc6e85196dd1bed0576c6
SHA512ff26ab5aba08f7188c442b5703260e2f651b207746a25b53443b41c9064680bba362664ea884bdfcb4ea2555750d688c00d1ae2952ef39f1b6a6d4a125aa8f34
-
Filesize
622KB
MD58935e8c56a13bd974f94373f187fc00b
SHA1ba4e69370f6954f87489508170ccf688aa323550
SHA2565d65e415b3e985162f67ce079d1e55723818b05e3aacc6e85196dd1bed0576c6
SHA512ff26ab5aba08f7188c442b5703260e2f651b207746a25b53443b41c9064680bba362664ea884bdfcb4ea2555750d688c00d1ae2952ef39f1b6a6d4a125aa8f34
-
Filesize
622KB
MD58935e8c56a13bd974f94373f187fc00b
SHA1ba4e69370f6954f87489508170ccf688aa323550
SHA2565d65e415b3e985162f67ce079d1e55723818b05e3aacc6e85196dd1bed0576c6
SHA512ff26ab5aba08f7188c442b5703260e2f651b207746a25b53443b41c9064680bba362664ea884bdfcb4ea2555750d688c00d1ae2952ef39f1b6a6d4a125aa8f34
-
Filesize
7KB
MD534560fe55cedf502185ee393c9a7cbad
SHA18f889c0dfd81cc45b7c1ed7e02c2ac218bdd1b88
SHA256c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534
SHA51245837ddb402d5c1ecca90068d439f9216b9efae08b49f887c5e2ee8754ff9acb14aea2aa7cd705d5f95ba1e8c4069dd87ff5dddcf6caee9b71d66dfbd060f382
-
Filesize
7KB
MD534560fe55cedf502185ee393c9a7cbad
SHA18f889c0dfd81cc45b7c1ed7e02c2ac218bdd1b88
SHA256c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534
SHA51245837ddb402d5c1ecca90068d439f9216b9efae08b49f887c5e2ee8754ff9acb14aea2aa7cd705d5f95ba1e8c4069dd87ff5dddcf6caee9b71d66dfbd060f382
-
Filesize
7KB
MD534560fe55cedf502185ee393c9a7cbad
SHA18f889c0dfd81cc45b7c1ed7e02c2ac218bdd1b88
SHA256c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534
SHA51245837ddb402d5c1ecca90068d439f9216b9efae08b49f887c5e2ee8754ff9acb14aea2aa7cd705d5f95ba1e8c4069dd87ff5dddcf6caee9b71d66dfbd060f382
-
Filesize
7KB
MD534560fe55cedf502185ee393c9a7cbad
SHA18f889c0dfd81cc45b7c1ed7e02c2ac218bdd1b88
SHA256c10aa251ae8985e2a0d937ee3d4fc564899f2ff847fb6ddc051dccc8fed4c534
SHA51245837ddb402d5c1ecca90068d439f9216b9efae08b49f887c5e2ee8754ff9acb14aea2aa7cd705d5f95ba1e8c4069dd87ff5dddcf6caee9b71d66dfbd060f382
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
472KB
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-