Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 00:19

General

  • Target

    ea85312349a1e9a78ef14a3536b7f40342cab1a2a645cb0ac4d51e5a3c651575.exe

  • Size

    184KB

  • MD5

    527c878d164b137e5ded518f44f0fc5a

  • SHA1

    0d81b47e0ba6d4a4b8e6a2219ca10d7cea54139e

  • SHA256

    ea85312349a1e9a78ef14a3536b7f40342cab1a2a645cb0ac4d51e5a3c651575

  • SHA512

    4f73c7f23c30c163f98ff03ac8f7becfb2d26ac90ebb5d4dd51330a767beab9eb834c4f6ac32b644c5c2722e12d69897d200b072b9ac30027ac297da3614e6c5

  • SSDEEP

    3072:FAj1cfl/BTyzcM+Knvmb7/D263i4qMbBQhAKIWOD2r1oX1/hcNcfAUane4RzsUZx:EClpTFzKnvmb7/D26y4qMSyKbOD2r1oG

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 54 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea85312349a1e9a78ef14a3536b7f40342cab1a2a645cb0ac4d51e5a3c651575.exe
    "C:\Users\Admin\AppData\Local\Temp\ea85312349a1e9a78ef14a3536b7f40342cab1a2a645cb0ac4d51e5a3c651575.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Users\Admin\laolij.exe
      "C:\Users\Admin\laolij.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1672

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\laolij.exe

    Filesize

    184KB

    MD5

    b2d0122ea6213609966d9692fc447129

    SHA1

    3f4b4400cbf91880c4d981da8e361e733ac074dc

    SHA256

    0421fdb11ab91e6f22438c6742947b4673f106c6f78b1e9edf1372a54be2b98f

    SHA512

    3f36dcbf12b514f608c760313f06e44e2f249e32a9d662e4bceceeac5dc160846598c3923233b125d2b81a188bab9a37da14a1e55be106a52867df203a5ed750

  • C:\Users\Admin\laolij.exe

    Filesize

    184KB

    MD5

    b2d0122ea6213609966d9692fc447129

    SHA1

    3f4b4400cbf91880c4d981da8e361e733ac074dc

    SHA256

    0421fdb11ab91e6f22438c6742947b4673f106c6f78b1e9edf1372a54be2b98f

    SHA512

    3f36dcbf12b514f608c760313f06e44e2f249e32a9d662e4bceceeac5dc160846598c3923233b125d2b81a188bab9a37da14a1e55be106a52867df203a5ed750

  • memory/1672-135-0x0000000000000000-mapping.dmp

  • memory/1672-138-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1672-142-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1912-132-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1912-141-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB