Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-11-2022 08:35
General
-
Target
8bed0a1984bb6d5a976fbedc736fe2a71048fc633f54d5286f0d0c1cc963eef2.exe
-
Size
69KB
-
MD5
17887b088376c4c22440b1e3fa6e62cc
-
SHA1
969be135099bdb5d34996a91137b51ab407cf50b
-
SHA256
8bed0a1984bb6d5a976fbedc736fe2a71048fc633f54d5286f0d0c1cc963eef2
-
SHA512
9ad33b12561374d433a23c19988b71ae61ba7f9dbc23c7c22f13f994b2d4e749dc4932628b84ce67d4e7b69ffd7c0b8925ecb0735043ef110c1a5a331e987273
-
SSDEEP
1536:JkTQy7RI8vUnOil3EWQCsITAunkNWcLy94zOPXUZNa:JkTQy6VBDQC1TAukkkyezCUW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bed0a1984bb6d5a976fbedc736fe2a71048fc633f54d5286f0d0c1cc963eef2.exe"C:\Users\Admin\AppData\Local\Temp\8bed0a1984bb6d5a976fbedc736fe2a71048fc633f54d5286f0d0c1cc963eef2.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\yahoo.exe"C:\Users\Admin\AppData\Roaming\yahoo.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\yahoo.exe" "yahoo.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\yahoo.exeFilesize
69KB
MD517887b088376c4c22440b1e3fa6e62cc
SHA1969be135099bdb5d34996a91137b51ab407cf50b
SHA2568bed0a1984bb6d5a976fbedc736fe2a71048fc633f54d5286f0d0c1cc963eef2
SHA5129ad33b12561374d433a23c19988b71ae61ba7f9dbc23c7c22f13f994b2d4e749dc4932628b84ce67d4e7b69ffd7c0b8925ecb0735043ef110c1a5a331e987273
-
C:\Users\Admin\AppData\Roaming\yahoo.exeFilesize
69KB
MD517887b088376c4c22440b1e3fa6e62cc
SHA1969be135099bdb5d34996a91137b51ab407cf50b
SHA2568bed0a1984bb6d5a976fbedc736fe2a71048fc633f54d5286f0d0c1cc963eef2
SHA5129ad33b12561374d433a23c19988b71ae61ba7f9dbc23c7c22f13f994b2d4e749dc4932628b84ce67d4e7b69ffd7c0b8925ecb0735043ef110c1a5a331e987273
-
memory/4284-132-0x00007FF87C250000-0x00007FF87CC86000-memory.dmpFilesize
10.2MB
-
memory/4592-137-0x0000000000000000-mapping.dmp
-
memory/5024-133-0x0000000000000000-mapping.dmp
-
memory/5024-136-0x00007FF87C250000-0x00007FF87CC86000-memory.dmpFilesize
10.2MB