Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
24-11-2022 13:00
General
-
Target
e0d2d9f20f52439359260206fac381a4475cf311d1a7f688531198a90d1db4f9.exe
-
Size
68KB
-
MD5
95f09326345b552a5d2430ff0fb8d88a
-
SHA1
23726288e522ce67060c2a941e7cc4fc789cd969
-
SHA256
e0d2d9f20f52439359260206fac381a4475cf311d1a7f688531198a90d1db4f9
-
SHA512
44ec9938ee00675b5d57cc76430e304593d00387cdcd1f25f77890df64924511f90262fc91c79daeb6d049a1e6e7e4f4d970f13d6921edd5f12bf6374ecc279d
-
SSDEEP
768:PcrliTduMAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:krIxzAcqOK3qowgnt1d
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0d2d9f20f52439359260206fac381a4475cf311d1a7f688531198a90d1db4f9.exe"C:\Users\Admin\AppData\Local\Temp\e0d2d9f20f52439359260206fac381a4475cf311d1a7f688531198a90d1db4f9.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5fff4c7b8dda7c9f64ef01580a8402b07
SHA1cb9e9b2477555ee830873fc7efefae87e0a19ec5
SHA25625209dbab0421a5efca52c590f62b65b712f5a17f8cec4c65a45e657a8d03763
SHA51227e708b523bc9da4a0e46eb935b9f401979801082dc14e52b70484cab697aee1edf9f59986e9c2a776c82c33ec353ef3e63320633d9719b5eb989b7f12ee03c9
-
Filesize
68KB
MD5fff4c7b8dda7c9f64ef01580a8402b07
SHA1cb9e9b2477555ee830873fc7efefae87e0a19ec5
SHA25625209dbab0421a5efca52c590f62b65b712f5a17f8cec4c65a45e657a8d03763
SHA51227e708b523bc9da4a0e46eb935b9f401979801082dc14e52b70484cab697aee1edf9f59986e9c2a776c82c33ec353ef3e63320633d9719b5eb989b7f12ee03c9
-
-
Filesize
84KB
-
Filesize
84KB