Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
24-11-2022 10:11
General
-
Target
000bf37f7b42976de72f88d286641b09d6d8b6d766df8989abb084242f56fa0e.exe
-
Size
462KB
-
MD5
de8e42d6fcf6317889264fd8ac46331d
-
SHA1
94d2f603504332f7330cc4032adea18d93bc2ee3
-
SHA256
000bf37f7b42976de72f88d286641b09d6d8b6d766df8989abb084242f56fa0e
-
SHA512
a31ca15e31f56cb0110a11821cde008da58ce62a5a4f6c7c742867987d42b7426ea63bb609632eacedb0b744152d3ab914bdeeeb287cfddff41801d3ed92b50a
-
SSDEEP
12288:MHX57zl29a/kCGZ+qFZhWUB3eTq3s0BFBs2:m57x29AujWUBj3TBFB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\000bf37f7b42976de72f88d286641b09d6d8b6d766df8989abb084242f56fa0e.exe"C:\Users\Admin\AppData\Local\Temp\000bf37f7b42976de72f88d286641b09d6d8b6d766df8989abb084242f56fa0e.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Explorer.exe"C:\Users\Admin\AppData\Roaming\Explorer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Explorer.exe" "Explorer.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Explorer.exeFilesize
462KB
MD5de8e42d6fcf6317889264fd8ac46331d
SHA194d2f603504332f7330cc4032adea18d93bc2ee3
SHA256000bf37f7b42976de72f88d286641b09d6d8b6d766df8989abb084242f56fa0e
SHA512a31ca15e31f56cb0110a11821cde008da58ce62a5a4f6c7c742867987d42b7426ea63bb609632eacedb0b744152d3ab914bdeeeb287cfddff41801d3ed92b50a
-
C:\Users\Admin\AppData\Roaming\Explorer.exeFilesize
462KB
MD5de8e42d6fcf6317889264fd8ac46331d
SHA194d2f603504332f7330cc4032adea18d93bc2ee3
SHA256000bf37f7b42976de72f88d286641b09d6d8b6d766df8989abb084242f56fa0e
SHA512a31ca15e31f56cb0110a11821cde008da58ce62a5a4f6c7c742867987d42b7426ea63bb609632eacedb0b744152d3ab914bdeeeb287cfddff41801d3ed92b50a
-
memory/2112-133-0x0000000000000000-mapping.dmp
-
memory/2112-136-0x00007FFC16930000-0x00007FFC17366000-memory.dmpFilesize
10.2MB
-
memory/3236-137-0x0000000000000000-mapping.dmp
-
memory/4516-132-0x00007FFC16930000-0x00007FFC17366000-memory.dmpFilesize
10.2MB