Analysis
-
max time kernel
169s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 18:38
General
-
Target
3ceef80c3de4e08f798a9d3a958da20cd1790a06e55a8805053f51a004b83d86.exe
-
Size
619KB
-
MD5
055e822885e9b0971b4e87b0ebfa4ab6
-
SHA1
c23f1fe682b87478bd3e327dd499960adf412aef
-
SHA256
3ceef80c3de4e08f798a9d3a958da20cd1790a06e55a8805053f51a004b83d86
-
SHA512
85fe528df5975ef29fb794f99a91dc9d0fab665c4fd8bc923f7a980ddefff00696441343c0684db1ad8894830d5c2f538b5fce3420520318c149a33ae5035afe
-
SSDEEP
12288:YkA5CuXTZVMUX8+fdS+D3niMcH+GjXyNrZWsg:Y15CuDZVMethD3i9HVXU9g
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 4 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ceef80c3de4e08f798a9d3a958da20cd1790a06e55a8805053f51a004b83d86.exe"C:\Users\Admin\AppData\Local\Temp\3ceef80c3de4e08f798a9d3a958da20cd1790a06e55a8805053f51a004b83d86.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3ceef80c3de4e08f798a9d3a958da20cd1790a06e55a8805053f51a004b83d86.exe"C:\Users\Admin\AppData\Local\Temp\3ceef80c3de4e08f798a9d3a958da20cd1790a06e55a8805053f51a004b83d86.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /z "C:\Users\Admin\AppData\Local\Temp\3ceef80c3de4e08f798a9d3a958da20cd1790a06e55a8805053f51a004b83d86.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3ceef80c3de4e08f798a9d3a958da20cd1790a06e55a8805053f51a004b83d86.exe"3⤵
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 24723⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /z "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acctres.exe"5⤵
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 23925⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224B
MD5c19eb8c8e7a40e6b987f9d2ee952996e
SHA16fc3049855bc9100643e162511673c6df0f28bfb
SHA256677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a
SHA512860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596
-
Filesize
619KB
MD5055e822885e9b0971b4e87b0ebfa4ab6
SHA1c23f1fe682b87478bd3e327dd499960adf412aef
SHA2563ceef80c3de4e08f798a9d3a958da20cd1790a06e55a8805053f51a004b83d86
SHA51285fe528df5975ef29fb794f99a91dc9d0fab665c4fd8bc923f7a980ddefff00696441343c0684db1ad8894830d5c2f538b5fce3420520318c149a33ae5035afe
-
Filesize
619KB
MD5055e822885e9b0971b4e87b0ebfa4ab6
SHA1c23f1fe682b87478bd3e327dd499960adf412aef
SHA2563ceef80c3de4e08f798a9d3a958da20cd1790a06e55a8805053f51a004b83d86
SHA51285fe528df5975ef29fb794f99a91dc9d0fab665c4fd8bc923f7a980ddefff00696441343c0684db1ad8894830d5c2f538b5fce3420520318c149a33ae5035afe
-
Filesize
619KB
MD5055e822885e9b0971b4e87b0ebfa4ab6
SHA1c23f1fe682b87478bd3e327dd499960adf412aef
SHA2563ceef80c3de4e08f798a9d3a958da20cd1790a06e55a8805053f51a004b83d86
SHA51285fe528df5975ef29fb794f99a91dc9d0fab665c4fd8bc923f7a980ddefff00696441343c0684db1ad8894830d5c2f538b5fce3420520318c149a33ae5035afe
-
Filesize
17KB
MD5fd03ff313a655e0b59dce81044bc6341
SHA10fa0dc26876f636956c3de82685bdbbc8ad3ef86
SHA2561f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9
SHA51200fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd
-
Filesize
17KB
MD5fd03ff313a655e0b59dce81044bc6341
SHA10fa0dc26876f636956c3de82685bdbbc8ad3ef86
SHA2561f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9
SHA51200fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd
-
Filesize
17KB
MD5fd03ff313a655e0b59dce81044bc6341
SHA10fa0dc26876f636956c3de82685bdbbc8ad3ef86
SHA2561f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9
SHA51200fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd
-
Filesize
17KB
MD5fd03ff313a655e0b59dce81044bc6341
SHA10fa0dc26876f636956c3de82685bdbbc8ad3ef86
SHA2561f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9
SHA51200fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
472KB
-
Filesize
5.7MB
-
-
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB