Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
23-11-2022 15:28
General
-
Target
c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63.exe
-
Size
3.2MB
-
MD5
60d87145479d73dae26ffdce16c1a071
-
SHA1
0206ace501f3760edf5be079951fcadd17c52c7b
-
SHA256
c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63
-
SHA512
cb90cc27e5f53e2b00e187d203191ef76e432592a5de1c2ca820b920c90e4b9999925da0ac25ed0890e360e7f3baa694003ffa811b45cdf96d74cb4833e57195
-
SSDEEP
98304:xFNW00i+rCrOZk8mXENd5VY8ScDnOsahMtAnZ:x9Tg4OZkdXEv0wODhMM
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 49 IoCs
-
NTFS ADS 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63.exe"C:\Users\Admin\AppData\Local\Temp\c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63.exe"C:\Users\Admin\AppData\Local\Temp\c219955852517964f6b6e795a52b1d0c425bd30ada4f061afe21f3d535642c63.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\Program Files\Javascript\Windows Up.EXE"c:\Program Files\Javascript\Windows Up.EXE"3⤵
- Executes dropped EXE
-
\??\c:\Program Files\Javascript\Windows Up.EXE"c:\Program Files\Javascript\Windows Up.EXE"4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD506fc08f4f00dc5e98e498e3e99859a77
SHA16177caa516a7aa72746bb4607364acfc572174cf
SHA2566dd5cba03075fdb4c555e718c2d80877aed428836dda6ba9d05af4dee7a76d56
SHA51213f744fdf416c95e367d6088e21dc08be2d54e13dbf48bcfba5defc2e22fcf63bc558bf2a44c10016cda787eb1ab7379b1a862b18e6221879be64cef80f25865
-
Filesize
2.0MB
MD506fc08f4f00dc5e98e498e3e99859a77
SHA16177caa516a7aa72746bb4607364acfc572174cf
SHA2566dd5cba03075fdb4c555e718c2d80877aed428836dda6ba9d05af4dee7a76d56
SHA51213f744fdf416c95e367d6088e21dc08be2d54e13dbf48bcfba5defc2e22fcf63bc558bf2a44c10016cda787eb1ab7379b1a862b18e6221879be64cef80f25865
-
Filesize
127B
MD5397ee39af9289f07f4b81b3c722008e6
SHA10e6e49239a9cd65e6ef848ecace7ce09b5c638d8
SHA256cb137ce7d0b2b6934b8f1094f6ada5123adcdcfa17bd8efa561bfb2f86e4b29c
SHA51294128a9b04750e9bed30ce94f793d0b71f6561d296303bd1c948de3389651b99ca83deb29ff44c9adfe0594f0d80f36f75088a6ecb2824f6c01ad05db642f639
-
Filesize
125B
MD5a7af2e45edc5b3684cac3e493c017ff3
SHA1f4ab1c4632f4161f825bd66ba8bb28be7589f0cc
SHA256c9449eaea86aa3bf9a4f75bc913b26b0b001ca62086ef9141a2f03bf6b82d9f7
SHA512bda826a7eef79339e89d4d7e1ee178aa5484e58b50644f6c8a907a0a4420b45d35bd382de7cef6edc5748b672b87b2240bce70eddc4aaa3c52df4bb843d4ecaf
-
Filesize
127B
MD51a94305d7378b7ddc1cf17096c418045
SHA10c5a33e69061f3985a3200523922199845ee035e
SHA256f1c1e47a939b121bbd61791580483335340bbdead4912c291b1abfa3d3f97ba1
SHA5125f65c3d364c8336b67fa09c46686d81d181d2854664bdcdd4e33f8a5f49d5d2f7a31c516297ddb42bb6d36cfde6772aa5eb0a7a02c1c36659fa0719bdbc98536
-
Filesize
127B
MD5f20f9bc3348798fe97949dcbe869b20e
SHA1ddc404bb1b2259ad7abfe6330edd5c485ba53170
SHA256bd0d781946d7cdf1b1183c1d54d39d63887b3345f19ca96103260456483c2c6b
SHA5123918b14bcb7f92b17904cbe036a786007388841e05e850313082c9775a4e0df0c4b7a8284ca2fd26419dd807b102edd3ed3e0b99f0a2d4879070fe06eba804ba
-
Filesize
2.0MB
MD506fc08f4f00dc5e98e498e3e99859a77
SHA16177caa516a7aa72746bb4607364acfc572174cf
SHA2566dd5cba03075fdb4c555e718c2d80877aed428836dda6ba9d05af4dee7a76d56
SHA51213f744fdf416c95e367d6088e21dc08be2d54e13dbf48bcfba5defc2e22fcf63bc558bf2a44c10016cda787eb1ab7379b1a862b18e6221879be64cef80f25865
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
3.7MB
-
Filesize
1.4MB
-
Filesize
3.7MB
-
Filesize
2.7MB
-
-
Filesize
2.7MB
-
Filesize
1.4MB
-
Filesize
2.7MB
-
-
Filesize
1.4MB