Analysis
-
max time kernel
143s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-11-2022 11:47
General
-
Target
2014-12-22 #32/439dce6b40c39157a046563bcb5e3a6a.exe
-
Size
664KB
-
MD5
439dce6b40c39157a046563bcb5e3a6a
-
SHA1
bd05604e465336df74df40bef6b6fbc3b360573a
-
SHA256
d72393d84be2be8fd53c5172a88327f47dee3c5276ca2a193b403ccc90308236
-
SHA512
f37e5e5c535284537b1f819da586c3166bd0e2e85c962b361f8e8c96f05958092cd1c093899683ad8d18121727e30d60ddbfab302e281f8cf90e1d068bfceb3a
-
SSDEEP
12288:ZK2mhAMJ/cPl+zyeuW/xcznRZ6Ko1JL7ffM2HRmQmxx/w:Y2O/Gl+GVW5clMJL7ffdH0Q0/w
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2014-12-22 #32\439dce6b40c39157a046563bcb5e3a6a.exe"C:\Users\Admin\AppData\Local\Temp\2014-12-22 #32\439dce6b40c39157a046563bcb5e3a6a.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Whatsapp spy tool.exe"C:\Program Files\Whatsapp spy tool.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\whatsapp.exe"C:\Program Files\whatsapp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\whatsapp.exe"C:\Program Files\whatsapp.exe"3⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 124⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4820 -ip 48201⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
398KB
MD584a8780b1647ca009326ebdfe99d464d
SHA11d1ecafd29e82d917967e910acca2e59c9a06e91
SHA25684d248a74552ee81d5895b4de05ac6801b46eca6eaedbb46d3c41f2484cd2741
SHA5124a7bf6ad1ab3ae9bcc1ecc6594c003e34f29c3e499d425c7ccd9ec531b5c8ffb87127d5d193d0a339fd62fff9903e40f3eea06f5bbc6368655620adfdc4dff1e
-
Filesize
398KB
MD584a8780b1647ca009326ebdfe99d464d
SHA11d1ecafd29e82d917967e910acca2e59c9a06e91
SHA25684d248a74552ee81d5895b4de05ac6801b46eca6eaedbb46d3c41f2484cd2741
SHA5124a7bf6ad1ab3ae9bcc1ecc6594c003e34f29c3e499d425c7ccd9ec531b5c8ffb87127d5d193d0a339fd62fff9903e40f3eea06f5bbc6368655620adfdc4dff1e
-
Filesize
1.1MB
MD54872b17a552e2a010f61d67655f789e6
SHA17ca0247a1ad4d0916c98ecd83bd6c8ab7d900651
SHA2567bcad7494ffef5dcc2d5ee786e25dbda8fb386c5cf812ddfe4fc02c1eb170929
SHA512a44cc6e5865b2cc8f3bf39e5b9bf57b4f0d8476f408512c874c52967e5862c40bc08f1296ea70be23837cb3ca07a12e8f69027521fd80f8a29d7d69baedc5d64
-
Filesize
1.1MB
MD54872b17a552e2a010f61d67655f789e6
SHA17ca0247a1ad4d0916c98ecd83bd6c8ab7d900651
SHA2567bcad7494ffef5dcc2d5ee786e25dbda8fb386c5cf812ddfe4fc02c1eb170929
SHA512a44cc6e5865b2cc8f3bf39e5b9bf57b4f0d8476f408512c874c52967e5862c40bc08f1296ea70be23837cb3ca07a12e8f69027521fd80f8a29d7d69baedc5d64
-
Filesize
1.1MB
MD54872b17a552e2a010f61d67655f789e6
SHA17ca0247a1ad4d0916c98ecd83bd6c8ab7d900651
SHA2567bcad7494ffef5dcc2d5ee786e25dbda8fb386c5cf812ddfe4fc02c1eb170929
SHA512a44cc6e5865b2cc8f3bf39e5b9bf57b4f0d8476f408512c874c52967e5862c40bc08f1296ea70be23837cb3ca07a12e8f69027521fd80f8a29d7d69baedc5d64
-
Filesize
5.6MB
-
Filesize
424KB
-
Filesize
624KB
-
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
344KB
-
-
Filesize
176KB
-
Filesize
5.7MB
-
-
Filesize
5.7MB