Analysis
-
max time kernel
161s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:24
General
-
Target
d0687fed1d0f70de0819e05328118f0a3f30e49e18294aefc48cdfa272afb143.exe
-
Size
2.8MB
-
MD5
4edaf05906df70748c350e60ddf06e6e
-
SHA1
ca389e8487727835d87f10bf20ec6a1f7ced5e36
-
SHA256
d0687fed1d0f70de0819e05328118f0a3f30e49e18294aefc48cdfa272afb143
-
SHA512
7348feb3421960b352afc778e9dc4039bcee02e244186960928317c186eec53a0648d8e18eabf6966ba3484c5bc25515a1c386ce56ace4ad2bffa46318d72788
-
SSDEEP
49152:pSYehJDrCie9mG0SHEs4t455xnx8J9Nk7EyivzvvTw+LDFT:4hpCKGw0nOJ9K7hSzvvDLD5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0687fed1d0f70de0819e05328118f0a3f30e49e18294aefc48cdfa272afb143.exe"C:\Users\Admin\AppData\Local\Temp\d0687fed1d0f70de0819e05328118f0a3f30e49e18294aefc48cdfa272afb143.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PlanetExplorers_10Tr_LNG_v0.75.exe"C:\Users\Admin\AppData\Local\Temp\PlanetExplorers_10Tr_LNG_v0.75.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x33c 0x3a41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PlanetExplorers_10Tr_LNG_v0.75.exeFilesize
2.6MB
MD570655072588e0ea5a80b9191b9ecfe46
SHA1246842134c513f08d9c276d7c12aa87d0b1a603a
SHA2566c6404b27e79536d85e429abef1570e59e24c3125ca8d149bd470ded6a309f29
SHA512d73caaa3b27d6ec7214f2300579135a320e8a4440632bb48c4dc4cbd1cd9380d506738e0aa55f958aac029dd1a181ce5d021e20ee52fb54d132f99499e72dc21
-
C:\Users\Admin\AppData\Local\Temp\PlanetExplorers_10Tr_LNG_v0.75.exeFilesize
2.6MB
MD570655072588e0ea5a80b9191b9ecfe46
SHA1246842134c513f08d9c276d7c12aa87d0b1a603a
SHA2566c6404b27e79536d85e429abef1570e59e24c3125ca8d149bd470ded6a309f29
SHA512d73caaa3b27d6ec7214f2300579135a320e8a4440632bb48c4dc4cbd1cd9380d506738e0aa55f958aac029dd1a181ce5d021e20ee52fb54d132f99499e72dc21
-
C:\Users\Admin\AppData\Local\Temp\nsy2925.tmp\AdvSplash.dllFilesize
6KB
MD5a1bba35c752b36f575350cb7ddf238e4
SHA19603b691ae71d4fbc7a14dbb837bd97cecac8aab
SHA2560667863d71a3021ab844069b6dd0485f874bf638af478ab11c6fb8b7d6c834b6
SHA512eb5d3498dd994bec42a437cf91343665d3c35bfe3f6277a7393af6a0b8348772c3166d9be48955edddf6ef79fa508ec8d4f96d7d5df37ecdc52c90042e0a2967
-
C:\Users\Admin\AppData\Local\Temp\nsy2925.tmp\NSISdl.dllFilesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
memory/4808-134-0x0000000000000000-mapping.dmp
-
memory/4808-137-0x0000000000400000-0x0000000000B1A000-memory.dmpFilesize
7.1MB
-
memory/4808-138-0x0000000000400000-0x0000000000B1A000-memory.dmpFilesize
7.1MB
-
memory/4808-139-0x0000000000400000-0x0000000000B1A000-memory.dmpFilesize
7.1MB
-
memory/4808-142-0x0000000000400000-0x0000000000B1A000-memory.dmpFilesize
7.1MB
-
memory/4808-143-0x0000000000400000-0x0000000000B1A000-memory.dmpFilesize
7.1MB