Analysis
-
max time kernel
184s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 14:32
General
-
Target
b9872e1ab1c6e17f1df163038b3d552648e3e87d7d5996cb5ce5b9696dbfb985.exe
-
Size
3.3MB
-
MD5
e457f8797ddb663e65dc833ecd6fabd6
-
SHA1
c16e8b5464a9087b8491e7ef59ce88e480f22253
-
SHA256
b9872e1ab1c6e17f1df163038b3d552648e3e87d7d5996cb5ce5b9696dbfb985
-
SHA512
e1fc29bf8373e54c169985a06ef4abf695866673b5a1619f3bf2da73d6afd6a7ac444826b6fd1d68a471ef1a3bd07b22103cc86ee5b4169473454378a9a5b503
-
SSDEEP
98304:s3YobVRxj94j/JpY6A7PFLiWg5RxjUZz+:OYeujnY6aIrYZa
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 22 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9872e1ab1c6e17f1df163038b3d552648e3e87d7d5996cb5ce5b9696dbfb985.exe"C:\Users\Admin\AppData\Local\Temp\b9872e1ab1c6e17f1df163038b3d552648e3e87d7d5996cb5ce5b9696dbfb985.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\drvprosetup.exeC:\Users\Admin\AppData\Local\Temp\\drvprosetup.exe /VERYSILENT2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6BM3E.tmp\drvprosetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-6BM3E.tmp\drvprosetup.tmp" /SL5="$A0056,2543061,85504,C:\Users\Admin\AppData\Local\Temp\drvprosetup.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Driver Pro\DPTray.exe"C:\Program Files (x86)\Driver Pro\DPTray.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Driver Pro\DriverPro.exe"C:\Program Files (x86)\Driver Pro\DriverPro.exe" /INSTALL4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Driver Pro\DPStartScan.exe"C:\Program Files (x86)\Driver Pro\DPStartScan.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Driver Pro\DriverPro.exe"C:\Program Files (x86)\Driver Pro\DriverPro.exe" /START5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
820KB
MD564a3304ed34f59eb2ca4c85158e4e8ed
SHA16b563fc8c535941f63839fb0bdfd2579cd3ad865
SHA2562e9586cae0c12a70fdd2e35ddc46596b532763b62c94b6dd2cea5ee42e73f17f
SHA5125641e24445f421ef63e1f2c4194ac386f21a96e56b31fa67b90267bdfc5c581173c9dea53807d2b36e070600a87c4b9daca0d50b0c513e1280d4134df0d326d7
-
Filesize
820KB
MD564a3304ed34f59eb2ca4c85158e4e8ed
SHA16b563fc8c535941f63839fb0bdfd2579cd3ad865
SHA2562e9586cae0c12a70fdd2e35ddc46596b532763b62c94b6dd2cea5ee42e73f17f
SHA5125641e24445f421ef63e1f2c4194ac386f21a96e56b31fa67b90267bdfc5c581173c9dea53807d2b36e070600a87c4b9daca0d50b0c513e1280d4134df0d326d7
-
Filesize
811KB
MD5f06e44eb136e46668096879742e58a8c
SHA1d54e9fd60eb93d2974f2d7e5fd7299ca419e8a58
SHA256168ebbb593a41ee01c5c9e7a5f085219b41e27dd85c2b3e76c28a3e9fb353e5a
SHA51297656608acee2f2589643959055678db48cc99a30598292994a41cf5c9d719b3c7c2e91240f70e889915138b5a7262919001876d92ff8d905223df0d648ea1b2
-
Filesize
811KB
MD5f06e44eb136e46668096879742e58a8c
SHA1d54e9fd60eb93d2974f2d7e5fd7299ca419e8a58
SHA256168ebbb593a41ee01c5c9e7a5f085219b41e27dd85c2b3e76c28a3e9fb353e5a
SHA51297656608acee2f2589643959055678db48cc99a30598292994a41cf5c9d719b3c7c2e91240f70e889915138b5a7262919001876d92ff8d905223df0d648ea1b2
-
Filesize
3.3MB
MD5e8c5c82535803c370436b6ee486e301f
SHA1ec8b28105fb0908370aaa8b02ab90b0979e4a2ef
SHA256d6c5623a2db50056acbbc6c77e982a4a4d6385f54bba94d4673ae7e2b44e4bac
SHA5125f0a13d054cc117272ce45f1f0bf615c15ee352d3ebb1b2ba17f24b6c5d3898d839b7fda66506cff3514d86019da1a47b965042cadcf1114f8669b82f565513e
-
Filesize
3.3MB
MD5e8c5c82535803c370436b6ee486e301f
SHA1ec8b28105fb0908370aaa8b02ab90b0979e4a2ef
SHA256d6c5623a2db50056acbbc6c77e982a4a4d6385f54bba94d4673ae7e2b44e4bac
SHA5125f0a13d054cc117272ce45f1f0bf615c15ee352d3ebb1b2ba17f24b6c5d3898d839b7fda66506cff3514d86019da1a47b965042cadcf1114f8669b82f565513e
-
Filesize
3.3MB
MD5e8c5c82535803c370436b6ee486e301f
SHA1ec8b28105fb0908370aaa8b02ab90b0979e4a2ef
SHA256d6c5623a2db50056acbbc6c77e982a4a4d6385f54bba94d4673ae7e2b44e4bac
SHA5125f0a13d054cc117272ce45f1f0bf615c15ee352d3ebb1b2ba17f24b6c5d3898d839b7fda66506cff3514d86019da1a47b965042cadcf1114f8669b82f565513e
-
Filesize
12KB
MD58f88e83e8022bfacd1e11529fcbac372
SHA12827f7593329022d8a6672133b67d542363e5be9
SHA256d4fa4405d07c959d8578d344d1fcb3bd834003682ea96ee49b048f7d1eba8679
SHA512dc3d181f416633a90297a43a710c77193c4b5c387037ad4084d10372a90151cba176330d4b463f07bc1c18f09c0a84be493e16e38b84946deaf081a6567af371
-
Filesize
508KB
MD50f66e8e2340569fb17e774dac2010e31
SHA1406bb6854e7384ff77c0b847bf2f24f3315874a3
SHA256de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f
SHA51239275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05
-
Filesize
508KB
MD50f66e8e2340569fb17e774dac2010e31
SHA1406bb6854e7384ff77c0b847bf2f24f3315874a3
SHA256de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f
SHA51239275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05
-
Filesize
508KB
MD50f66e8e2340569fb17e774dac2010e31
SHA1406bb6854e7384ff77c0b847bf2f24f3315874a3
SHA256de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f
SHA51239275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05
-
Filesize
2.9MB
MD520a1ff6efbfc6d83a0a6008f45914e9e
SHA1c3bda8bb56403824402e825ec2c7e022e7d31c13
SHA256508060dc54b63e210eb42a4f0519a7eb09ac8c1138084b078795ba9bb2bd0828
SHA5124b3d5d159f5d660b29a6908cf23336272afe475b479a70ba2de5dc067106f2d026f13ccffd43318611e96f2dc4cd1f770474a288a26ebee59a31db891c461f23
-
Filesize
2.9MB
MD520a1ff6efbfc6d83a0a6008f45914e9e
SHA1c3bda8bb56403824402e825ec2c7e022e7d31c13
SHA256508060dc54b63e210eb42a4f0519a7eb09ac8c1138084b078795ba9bb2bd0828
SHA5124b3d5d159f5d660b29a6908cf23336272afe475b479a70ba2de5dc067106f2d026f13ccffd43318611e96f2dc4cd1f770474a288a26ebee59a31db891c461f23
-
Filesize
1.1MB
MD5938604f6ac59637bac93477c279247b2
SHA17d463ead499fb69ee4d785429ba8783b5bbef43a
SHA25638a41372c1ca922a7aa14c82fd09656c0d168acf9cbc481b8e3d05f2302bcce3
SHA5122e22e8c7c4f0652bba62eec7e8103e530c0a6a5a61aedb13bf2501ffa158bc02a3efbdb36684fa80b282b50225e5e1385dd27b25c98a7b18eb97e55d445fd3eb
-
Filesize
1.1MB
MD5938604f6ac59637bac93477c279247b2
SHA17d463ead499fb69ee4d785429ba8783b5bbef43a
SHA25638a41372c1ca922a7aa14c82fd09656c0d168acf9cbc481b8e3d05f2302bcce3
SHA5122e22e8c7c4f0652bba62eec7e8103e530c0a6a5a61aedb13bf2501ffa158bc02a3efbdb36684fa80b282b50225e5e1385dd27b25c98a7b18eb97e55d445fd3eb
-
Filesize
124KB
-
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
-
-
-
-