Analysis
-
max time kernel
155s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25/11/2022, 22:56
General
-
Target
7844d22d6f0ce7b481f63eeaf93d087412982f87a37b686e7a86a673bbcba0bc.exe
-
Size
4.1MB
-
MD5
e38a921dd0ec2715d9ed7d6aea932943
-
SHA1
642c12d97c64649f6025438d5a0029114026e039
-
SHA256
7844d22d6f0ce7b481f63eeaf93d087412982f87a37b686e7a86a673bbcba0bc
-
SHA512
ebe03cfc3f4952e2a49d7fdd430ad9a852bbe1550dfccd4f4af28c4788acabf9699fbc4981baccdfe5b06276ee5990af1f098ae79d9c52ad296540e5e3cc8fce
-
SSDEEP
49152:QZPOAH6b2W8Ox1drCHqPtAppGghVZSNHzSFl/8/yOE2zrMfB6696cZhd06jHM9kz:QZpxOfd2Ag8TSFeFjI/9J1ZMeKg4sscR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7844d22d6f0ce7b481f63eeaf93d087412982f87a37b686e7a86a673bbcba0bc.exe"C:\Users\Admin\AppData\Local\Temp\7844d22d6f0ce7b481f63eeaf93d087412982f87a37b686e7a86a673bbcba0bc.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\login.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\login.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5b9d00588e709536cbb117e3db5c81b81
SHA18809c2a2d97af12e8c0a700ed4129e6b9d5b3b19
SHA2560f2608cc8b6fa2143424cec9cfe12d6ff1bc41317fdd92f5c8ef3b77f81d4ace
SHA512a45bb2ff04ae8c81a31308a8baa3800a796e4abe9a6489ab952b7807dcfb40fdd89a6f15500724122726e1b86defb05fe27408198d5553edc83cbf43d48e443b
-
Filesize
3.2MB
MD5b9d00588e709536cbb117e3db5c81b81
SHA18809c2a2d97af12e8c0a700ed4129e6b9d5b3b19
SHA2560f2608cc8b6fa2143424cec9cfe12d6ff1bc41317fdd92f5c8ef3b77f81d4ace
SHA512a45bb2ff04ae8c81a31308a8baa3800a796e4abe9a6489ab952b7807dcfb40fdd89a6f15500724122726e1b86defb05fe27408198d5553edc83cbf43d48e443b
-
Filesize
9.0MB
-
Filesize
9.0MB
-
Filesize
9.0MB
-
Filesize
9.0MB
-
Filesize
9.0MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
2.1MB
-
Filesize
1024KB
-
Filesize
4.0MB
-
Filesize
1024KB
-
Filesize
488KB
-
Filesize
4.0MB