Analysis
-
max time kernel
158s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-11-2022 22:40
General
-
Target
9fd868358712a7197667f60d896209bfec81c5c80c200baba261eea3b6e94b7c.exe
-
Size
61KB
-
MD5
84fbf0b6ad4a8e090f0c46fb7014314a
-
SHA1
35fb8bf532863e769660070079799ada057af7c7
-
SHA256
9fd868358712a7197667f60d896209bfec81c5c80c200baba261eea3b6e94b7c
-
SHA512
143f87e4303b391df1e5ff1142ec94c67051a02fdf957dfbec6c95048983e037336ec93b41ec0aacde73852e79276fc4a29e1f69e36b63664c9552bd54e6310b
-
SSDEEP
768:fwSlBy8rR4OtJ1JYconEfEbIT/DtRw0FJ8pmp+Ou3UA5KDFQMSbowBA3iNsrie:fnlByQRonEfuIT/Dw5ZTKEHfNsl
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fd868358712a7197667f60d896209bfec81c5c80c200baba261eea3b6e94b7c.exe"C:\Users\Admin\AppData\Local\Temp\9fd868358712a7197667f60d896209bfec81c5c80c200baba261eea3b6e94b7c.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\appdata\roaming\MSOffice Users Licenses\comhost.exe"C:\Users\Admin\appdata\roaming\MSOffice Users Licenses\comhost.exe" "c:\users\admin\appdata\local\temp\9fd868358712a7197667f60d896209bfec81c5c80c200baba261eea3b6e94b7c.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\csrsss.exe"C:\Users\Admin\AppData\Local\Temp\csrsss.exe" -mon3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD584fbf0b6ad4a8e090f0c46fb7014314a
SHA135fb8bf532863e769660070079799ada057af7c7
SHA2569fd868358712a7197667f60d896209bfec81c5c80c200baba261eea3b6e94b7c
SHA512143f87e4303b391df1e5ff1142ec94c67051a02fdf957dfbec6c95048983e037336ec93b41ec0aacde73852e79276fc4a29e1f69e36b63664c9552bd54e6310b
-
Filesize
61KB
MD584fbf0b6ad4a8e090f0c46fb7014314a
SHA135fb8bf532863e769660070079799ada057af7c7
SHA2569fd868358712a7197667f60d896209bfec81c5c80c200baba261eea3b6e94b7c
SHA512143f87e4303b391df1e5ff1142ec94c67051a02fdf957dfbec6c95048983e037336ec93b41ec0aacde73852e79276fc4a29e1f69e36b63664c9552bd54e6310b
-
Filesize
61KB
MD584fbf0b6ad4a8e090f0c46fb7014314a
SHA135fb8bf532863e769660070079799ada057af7c7
SHA2569fd868358712a7197667f60d896209bfec81c5c80c200baba261eea3b6e94b7c
SHA512143f87e4303b391df1e5ff1142ec94c67051a02fdf957dfbec6c95048983e037336ec93b41ec0aacde73852e79276fc4a29e1f69e36b63664c9552bd54e6310b
-
Filesize
61KB
MD584fbf0b6ad4a8e090f0c46fb7014314a
SHA135fb8bf532863e769660070079799ada057af7c7
SHA2569fd868358712a7197667f60d896209bfec81c5c80c200baba261eea3b6e94b7c
SHA512143f87e4303b391df1e5ff1142ec94c67051a02fdf957dfbec6c95048983e037336ec93b41ec0aacde73852e79276fc4a29e1f69e36b63664c9552bd54e6310b
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB