Overview

overview

10

Static

static

772a930471...4d.exe

windows7-x64

10

772a930471...4d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    153s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 20:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe

  • Size

    40KB

  • MD5

    7a22bbfd531b77e796eb1459d41cd806

  • SHA1

    28819871c8ced277329f462f2283d5367548a907

  • SHA256

    772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d

  • SHA512

    418777d2702d0f69c857013659b3303a1cd7bea94cf03979c61e7fc7082427b9f3e11767f46f7a87ab1c87226dba29f4ea3ef7f17c2bba5f5c9f883df429a248

  • SSDEEP

    768:BVmfIz1X61wO2J6OpY9x0dHXOHk3CCecGH9C/vc:B1z8wO2J6IY9x6w4RCsvc

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe
    "C:\Users\Admin\AppData\Local\Temp\772a93047136f4d3d714cd1ad7400957f5411a8cbfbc51380dd8339129d0e94d.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:5004

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Admin.exe
    Filesize

    40KB

    MD5

    167f29b96da2b11a05b217b3364f5f69

    SHA1

    ddeee2f35082b2f82d1fbbfc31726a321473a138

    SHA256

    dbcb9ce2e0fbffc1bcd680a47cfbceee0048d919e06a5a32870993c1fdfee37e

    SHA512

    aa70437c7638697737a8d241cc79af93cb170687bad382bf67af19c2d3adca42e4ce29a4baee06a45c512c70bdaf3401daf60c6ce1ba0007f1f75ff94b461087

    Download Submit

  • C:\Users\Admin\Admin.exe
    Filesize

    40KB

    MD5

    167f29b96da2b11a05b217b3364f5f69

    SHA1

    ddeee2f35082b2f82d1fbbfc31726a321473a138

    SHA256

    dbcb9ce2e0fbffc1bcd680a47cfbceee0048d919e06a5a32870993c1fdfee37e

    SHA512

    aa70437c7638697737a8d241cc79af93cb170687bad382bf67af19c2d3adca42e4ce29a4baee06a45c512c70bdaf3401daf60c6ce1ba0007f1f75ff94b461087

    Download Submit

  • memory/5004-134-0x0000000000000000-mapping.dmp

    Download