Analysis
-
max time kernel
204s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 19:35
General
-
Target
c4a0d874ecbaf3865c3907f3fbd89014b5953cb9d5c8ca69a72c1a83e2143e96.exe
-
Size
207KB
-
MD5
1dd570fecefd5c56cb21ed7ee72c8b41
-
SHA1
0fb3a84783f1342cc68afa053961f16d1280ea6e
-
SHA256
c4a0d874ecbaf3865c3907f3fbd89014b5953cb9d5c8ca69a72c1a83e2143e96
-
SHA512
ff9ebebb8bb2e8ee414477dff5a95542dc5d8ba25c63c1c2c45adac6ecfd9bfbe08e8bf32c564fa30601a2e4ae02f6f017ae0491383740a11d778e4d3e2a3589
-
SSDEEP
3072:m9Va9YHpRXusg+nNAxL70OUizr1QtrXvtQo+r+D2fL5rC63Q77NOmYZAWkdJqxLu:Hf9dQ7JQ3kdM/9ikg/8KJnz8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4a0d874ecbaf3865c3907f3fbd89014b5953cb9d5c8ca69a72c1a83e2143e96.exe"C:\Users\Admin\AppData\Local\Temp\c4a0d874ecbaf3865c3907f3fbd89014b5953cb9d5c8ca69a72c1a83e2143e96.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\explorer.exe" "explorer.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
207KB
MD51dd570fecefd5c56cb21ed7ee72c8b41
SHA10fb3a84783f1342cc68afa053961f16d1280ea6e
SHA256c4a0d874ecbaf3865c3907f3fbd89014b5953cb9d5c8ca69a72c1a83e2143e96
SHA512ff9ebebb8bb2e8ee414477dff5a95542dc5d8ba25c63c1c2c45adac6ecfd9bfbe08e8bf32c564fa30601a2e4ae02f6f017ae0491383740a11d778e4d3e2a3589
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
207KB
MD51dd570fecefd5c56cb21ed7ee72c8b41
SHA10fb3a84783f1342cc68afa053961f16d1280ea6e
SHA256c4a0d874ecbaf3865c3907f3fbd89014b5953cb9d5c8ca69a72c1a83e2143e96
SHA512ff9ebebb8bb2e8ee414477dff5a95542dc5d8ba25c63c1c2c45adac6ecfd9bfbe08e8bf32c564fa30601a2e4ae02f6f017ae0491383740a11d778e4d3e2a3589
-
memory/1412-133-0x00007FFEAEBA0000-0x00007FFEAF5D6000-memory.dmpFilesize
10.2MB
-
memory/1644-138-0x0000000000000000-mapping.dmp
-
memory/3440-134-0x0000000000000000-mapping.dmp
-
memory/3440-137-0x00007FFEAEBA0000-0x00007FFEAF5D6000-memory.dmpFilesize
10.2MB