Analysis
-
max time kernel
182s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
27-11-2022 07:06
General
-
Target
caa465e63287335c8a4b13ad6adb60f49c4aff55e40ac40f5694829fae11db53.exe
-
Size
25KB
-
MD5
b9841a0f9a092cafe713e08ad5340e24
-
SHA1
255c1d9653ab94d29fe5f65510ff084b9ea140c2
-
SHA256
caa465e63287335c8a4b13ad6adb60f49c4aff55e40ac40f5694829fae11db53
-
SHA512
f76568cbf1dc419ab39b78b7fb6446a21d5d777dc7a5468beea770d9b7b19a424444f71114db0610cc23a73f2224996182542df79d24774b868ba1ea90eb6a7d
-
SSDEEP
384:fwVTyPgD6SgOViuyg0pBH2W4Gah9WrUk2MgDqDkIcBsQe6nnfThCNqtz9cLKD:oLGQViuygAyuUk2CgHBZ5nwCe
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\caa465e63287335c8a4b13ad6adb60f49c4aff55e40ac40f5694829fae11db53.exe"C:\Users\Admin\AppData\Local\Temp\caa465e63287335c8a4b13ad6adb60f49c4aff55e40ac40f5694829fae11db53.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\7724.vbs"2⤵
-
-
C:\Program Files (x86)\cmss.exe"C:\Program Files (x86)\cmss.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500B
MD5f987ed9a13348b7bbf4da9dacb355b7d
SHA1c2cc0febd562297648304dc78bf845eb6409e9e3
SHA256a9ed7a8126aa3f99df4ecd9e7fb6c673d28811f9b5644c48f048c7d415b308a1
SHA512159befd0b4c47935292707dee46eb64257472a0a41ecc5cc4dbffc91a07782c9a25d2fdc93f59d77b78454a0dbb5b1ee2a73f4bcb51311e5e238775b090a78e3
-
Filesize
25KB
MD5b9841a0f9a092cafe713e08ad5340e24
SHA1255c1d9653ab94d29fe5f65510ff084b9ea140c2
SHA256caa465e63287335c8a4b13ad6adb60f49c4aff55e40ac40f5694829fae11db53
SHA512f76568cbf1dc419ab39b78b7fb6446a21d5d777dc7a5468beea770d9b7b19a424444f71114db0610cc23a73f2224996182542df79d24774b868ba1ea90eb6a7d
-
Filesize
25KB
MD5b9841a0f9a092cafe713e08ad5340e24
SHA1255c1d9653ab94d29fe5f65510ff084b9ea140c2
SHA256caa465e63287335c8a4b13ad6adb60f49c4aff55e40ac40f5694829fae11db53
SHA512f76568cbf1dc419ab39b78b7fb6446a21d5d777dc7a5468beea770d9b7b19a424444f71114db0610cc23a73f2224996182542df79d24774b868ba1ea90eb6a7d
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB