Analysis
-
max time kernel
196s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 20:58
General
-
Target
872ea02150ecd0b2c46aae1b4afda9d9a50870a467a2c935c21a0d0a11101eb2.exe
-
Size
68KB
-
MD5
640ee5aca02880858e882006ea36b202
-
SHA1
41d38e5ceca634d08a612dfe66cb0f250d23a2ae
-
SHA256
872ea02150ecd0b2c46aae1b4afda9d9a50870a467a2c935c21a0d0a11101eb2
-
SHA512
8a82b7c6d8ff6617f88f73f90c08ee89fe835d0703ff7d89d2c92731827154d4c37c05de12b9ffafe7754efab02cdc5c10af8b3caf8b4d34d7944409f50b71a6
-
SSDEEP
768:UcgliTdOqAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:TgIx5AcqOK3qowgnt1d
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\872ea02150ecd0b2c46aae1b4afda9d9a50870a467a2c935c21a0d0a11101eb2.exe"C:\Users\Admin\AppData\Local\Temp\872ea02150ecd0b2c46aae1b4afda9d9a50870a467a2c935c21a0d0a11101eb2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD56d97481f162dc8c56af3e0e6b7b3d0e7
SHA14b1aa71db13ac6b00c2938ebed3f5c1cf5444c2a
SHA2566f47c6a48ba85be8992722dcea500445a96c45f1132e1165fccc36fa72d19405
SHA5127ccae453faec188f6c0de92ba84b257924316cc6d1fd75640257213b082f90fe6c875b77ab7bd60aca254910e7bb654d065bc44d8dcc14d4bb93e1b66b93e5ca
-
Filesize
68KB
MD56d97481f162dc8c56af3e0e6b7b3d0e7
SHA14b1aa71db13ac6b00c2938ebed3f5c1cf5444c2a
SHA2566f47c6a48ba85be8992722dcea500445a96c45f1132e1165fccc36fa72d19405
SHA5127ccae453faec188f6c0de92ba84b257924316cc6d1fd75640257213b082f90fe6c875b77ab7bd60aca254910e7bb654d065bc44d8dcc14d4bb93e1b66b93e5ca
-
Filesize
84KB
-
-
Filesize
84KB