Overview

overview

10

Static

static

1b720c4ff7...65.exe

windows7-x64

10

1b720c4ff7...65.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    271s
  • max time network
    371s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 00:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1b720c4ff748f45b527cd8a6b41b560c2514106492bc7867fd361be0eab9ce65.exe

  • Size

    152KB

  • MD5

    34a8816d73167010d0a2a066ca51da30

  • SHA1

    84f4fc8bd272965d0b831c8b5f5aebe01a2401bb

  • SHA256

    1b720c4ff748f45b527cd8a6b41b560c2514106492bc7867fd361be0eab9ce65

  • SHA512

    1bc40d63988ea7ab3afcb42afd23c7490d275a5f35557838076611d3a72ab289badb7a7341d0c39ee3932a339a5eb71431fc4a18f1b47b75a7a35616f9dfb062

  • SSDEEP

    3072:H3skvl3Po5+tTjFqV+t3DRGCKBiAKN4oQZiEue:VQ5+t8+NDR5AWW9

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 34 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b720c4ff748f45b527cd8a6b41b560c2514106492bc7867fd361be0eab9ce65.exe
    "C:\Users\Admin\AppData\Local\Temp\1b720c4ff748f45b527cd8a6b41b560c2514106492bc7867fd361be0eab9ce65.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3268
    • C:\Users\Admin\waesup.exe
      "C:\Users\Admin\waesup.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\waesup.exe
    Filesize

    152KB

    MD5

    86a8377bdf83b40c316c736c2b775afb

    SHA1

    b4475e4d0406eb75d8d3b1a73ac0236ec261dac9

    SHA256

    9c376972c3b5917e72879d8981f7501cc64e5584057720c726eab490ad7d6459

    SHA512

    935927448cc72405f4ded8fa2e76d71fa0bc18166d33e41e353183330a612f20818a5b002c56faf889ee2a69889e279ab8204dd91b45bdeb83a4c1b4b9dbe972

    Download Submit
  • C:\Users\Admin\waesup.exe
    Filesize

    152KB

    MD5

    86a8377bdf83b40c316c736c2b775afb

    SHA1

    b4475e4d0406eb75d8d3b1a73ac0236ec261dac9

    SHA256

    9c376972c3b5917e72879d8981f7501cc64e5584057720c726eab490ad7d6459

    SHA512

    935927448cc72405f4ded8fa2e76d71fa0bc18166d33e41e353183330a612f20818a5b002c56faf889ee2a69889e279ab8204dd91b45bdeb83a4c1b4b9dbe972

    Download Submit
  • memory/2952-134-0x0000000000000000-mapping.dmp
    Download