Analysis
-
max time kernel
208s -
max time network
288s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 15:28
General
-
Target
c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63.exe
-
Size
3.2MB
-
MD5
60d87145479d73dae26ffdce16c1a071
-
SHA1
0206ace501f3760edf5be079951fcadd17c52c7b
-
SHA256
c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63
-
SHA512
cb90cc27e5f53e2b00e187d203191ef76e432592a5de1c2ca820b920c90e4b9999925da0ac25ed0890e360e7f3baa694003ffa811b45cdf96d74cb4833e57195
-
SSDEEP
98304:xFNW00i+rCrOZk8mXENd5VY8ScDnOsahMtAnZ:x9Tg4OZkdXEv0wODhMM
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 39 IoCs
-
NTFS ADS 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63.exe"C:\Users\Admin\AppData\Local\Temp\c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63.exe"C:\Users\Admin\AppData\Local\Temp\c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63.exe"2⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\Program Files\Javascript\Windows Up.EXE"c:\Program Files\Javascript\Windows Up.EXE"3⤵
- Executes dropped EXE
-
\??\c:\Program Files\Javascript\Windows Up.EXE"c:\Program Files\Javascript\Windows Up.EXE"4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD506fc08f4f00dc5e98e498e3e99859a77
SHA16177caa516a7aa72746bb4607364acfc572174cf
SHA2566dd5cba03075fdb4c555e718c2d80877aed428836dda6ba9d05af4dee7a76d56
SHA51213f744fdf416c95e367d6088e21dc08be2d54e13dbf48bcfba5defc2e22fcf63bc558bf2a44c10016cda787eb1ab7379b1a862b18e6221879be64cef80f25865
-
Filesize
2.0MB
MD506fc08f4f00dc5e98e498e3e99859a77
SHA16177caa516a7aa72746bb4607364acfc572174cf
SHA2566dd5cba03075fdb4c555e718c2d80877aed428836dda6ba9d05af4dee7a76d56
SHA51213f744fdf416c95e367d6088e21dc08be2d54e13dbf48bcfba5defc2e22fcf63bc558bf2a44c10016cda787eb1ab7379b1a862b18e6221879be64cef80f25865
-
Filesize
127B
MD56a360392f66d6f84b38a9270d533640b
SHA1b65502a9dcd9d287e5ac32060c02294623387f77
SHA256e94e3a414283e1090a11b71519dd1ca27f49d139b157ef16e5cc6277ba0f541c
SHA512c72e571678ee67f03b66e718455fd1884f35c49f5fcb28f39936e2e5b0c1e09373f2c6fc5005cbb57fb4f488105d65e07e6f1ea4ad0d7935f9e93a5ef1a6d2d9
-
Filesize
2.0MB
MD506fc08f4f00dc5e98e498e3e99859a77
SHA16177caa516a7aa72746bb4607364acfc572174cf
SHA2566dd5cba03075fdb4c555e718c2d80877aed428836dda6ba9d05af4dee7a76d56
SHA51213f744fdf416c95e367d6088e21dc08be2d54e13dbf48bcfba5defc2e22fcf63bc558bf2a44c10016cda787eb1ab7379b1a862b18e6221879be64cef80f25865
-
Filesize
2.0MB
MD506fc08f4f00dc5e98e498e3e99859a77
SHA16177caa516a7aa72746bb4607364acfc572174cf
SHA2566dd5cba03075fdb4c555e718c2d80877aed428836dda6ba9d05af4dee7a76d56
SHA51213f744fdf416c95e367d6088e21dc08be2d54e13dbf48bcfba5defc2e22fcf63bc558bf2a44c10016cda787eb1ab7379b1a862b18e6221879be64cef80f25865
-
Filesize
2.0MB
MD506fc08f4f00dc5e98e498e3e99859a77
SHA16177caa516a7aa72746bb4607364acfc572174cf
SHA2566dd5cba03075fdb4c555e718c2d80877aed428836dda6ba9d05af4dee7a76d56
SHA51213f744fdf416c95e367d6088e21dc08be2d54e13dbf48bcfba5defc2e22fcf63bc558bf2a44c10016cda787eb1ab7379b1a862b18e6221879be64cef80f25865
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
3.7MB
-
-
Filesize
1.4MB
-
Filesize
2.7MB
-
Filesize
64KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
1.4MB
-
Filesize
2.7MB
-
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
8KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
-
Filesize
2.7MB
-
Filesize
2.7MB