Analysis
-
max time kernel
49s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
24-11-2022 00:22
General
-
Target
e9781ddc7c8bfff2f7c269edcb370f3da73adf1b1350d629918e5cdfa6f64050.exe
-
Size
208KB
-
MD5
27077ddbe1ad2c815936c11a5c405d80
-
SHA1
083a868c9f7f0870d4bf01ae12ac2d9fc97127c8
-
SHA256
e9781ddc7c8bfff2f7c269edcb370f3da73adf1b1350d629918e5cdfa6f64050
-
SHA512
20b2a6aa395d0e493aac76814a6f78b8502cb860575715114ee6d63ce15e5b7aa709fab82fa80d0f1fb19a55c80820e790ee3f1f13b8336aadaa93dc758e9a1e
-
SSDEEP
6144:ln0Qk0GazmqAJHOlb4nDlClsfbLEaEAioyLwKds23efHXkD5D5yasfSqR:1kdazmqAJHOlb4nDYlibLEaEAioyLwKS
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 20 IoCs
-
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9781ddc7c8bfff2f7c269edcb370f3da73adf1b1350d629918e5cdfa6f64050.exe"C:\Users\Admin\AppData\Local\Temp\e9781ddc7c8bfff2f7c269edcb370f3da73adf1b1350d629918e5cdfa6f64050.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\seimoj.exe"C:\Users\Admin\seimoj.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\seimoj.exeFilesize
208KB
MD527077ddbe1ad2c815936c11a5c405d80
SHA1083a868c9f7f0870d4bf01ae12ac2d9fc97127c8
SHA256e9781ddc7c8bfff2f7c269edcb370f3da73adf1b1350d629918e5cdfa6f64050
SHA51220b2a6aa395d0e493aac76814a6f78b8502cb860575715114ee6d63ce15e5b7aa709fab82fa80d0f1fb19a55c80820e790ee3f1f13b8336aadaa93dc758e9a1e
-
C:\Users\Admin\seimoj.exeFilesize
208KB
MD527077ddbe1ad2c815936c11a5c405d80
SHA1083a868c9f7f0870d4bf01ae12ac2d9fc97127c8
SHA256e9781ddc7c8bfff2f7c269edcb370f3da73adf1b1350d629918e5cdfa6f64050
SHA51220b2a6aa395d0e493aac76814a6f78b8502cb860575715114ee6d63ce15e5b7aa709fab82fa80d0f1fb19a55c80820e790ee3f1f13b8336aadaa93dc758e9a1e
-
memory/3104-134-0x0000000000000000-mapping.dmp