Analysis
-
max time kernel
151s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
23-11-2022 15:32
General
-
Target
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe
-
Size
627KB
-
MD5
c0dbf7da39a106dd0bd52425ecc7c7fb
-
SHA1
2e3e1013e2c37b2e494b1d21fad30535e0c95c56
-
SHA256
8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff
-
SHA512
7573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c
-
SSDEEP
12288:DHGMlyPzdD0cxpxX7/cTb8rMpyRZfMgoCvUFhi:bqPL1rgAYuZL
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 4 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /z "C:\Users\Admin\AppData\Local\Temp\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff.exe"3⤵
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 24923⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /z "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acctres.exe"5⤵
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 24685⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224B
MD5c19eb8c8e7a40e6b987f9d2ee952996e
SHA16fc3049855bc9100643e162511673c6df0f28bfb
SHA256677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a
SHA512860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596
-
Filesize
627KB
MD5c0dbf7da39a106dd0bd52425ecc7c7fb
SHA12e3e1013e2c37b2e494b1d21fad30535e0c95c56
SHA2568b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff
SHA5127573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c
-
Filesize
627KB
MD5c0dbf7da39a106dd0bd52425ecc7c7fb
SHA12e3e1013e2c37b2e494b1d21fad30535e0c95c56
SHA2568b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff
SHA5127573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c
-
Filesize
627KB
MD5c0dbf7da39a106dd0bd52425ecc7c7fb
SHA12e3e1013e2c37b2e494b1d21fad30535e0c95c56
SHA2568b951df5a82464480141242d2d02b0cf49ec7ceb172c9fb1bf3827dcb14b50ff
SHA5127573c3cd6729e10d5cc6a6d3e9050ad7303b088d33364ba3887069e31f9e8aebdf719eccde89d95b098b3a3778932205075ee2be07ac7f2b4b2216733bdfbe8c
-
Filesize
6KB
MD5e60d6745837845b4797f6266fdeb756d
SHA1bd4a42994d2c4ced86722e5f0cbc770eed89b538
SHA256af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2
SHA5122a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc
-
Filesize
6KB
MD5e60d6745837845b4797f6266fdeb756d
SHA1bd4a42994d2c4ced86722e5f0cbc770eed89b538
SHA256af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2
SHA5122a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc
-
Filesize
6KB
MD5e60d6745837845b4797f6266fdeb756d
SHA1bd4a42994d2c4ced86722e5f0cbc770eed89b538
SHA256af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2
SHA5122a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc
-
Filesize
6KB
MD5e60d6745837845b4797f6266fdeb756d
SHA1bd4a42994d2c4ced86722e5f0cbc770eed89b538
SHA256af4ccdd2b99f562597f71e67246fe6d759e574a7c521e72bf7ba08853cd635a2
SHA5122a6a3c10a1f084caca40c7f9b86775df4e0f2e8c17ef9415b73344da87f7a702a9430bbffe5e6d39d5aaebf3841edcbb3754309caf84358718009abf08ac3bcc
-
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
-
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
472KB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB