Overview

overview

10

Static

static

de0be96e2f...b3.exe

windows7-x64

10

de0be96e2f...b3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2022 16:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    de0be96e2f6e851e9839cf839fca7ec86e07d8d745d936c8a8dcbe9efddc54b3.exe

  • Size

    68KB

  • MD5

    81f7efe3adda0f0002ba7f1fe330d737

  • SHA1

    fe18182149ba916faa62541a5eee98ea181d1fc4

  • SHA256

    de0be96e2f6e851e9839cf839fca7ec86e07d8d745d936c8a8dcbe9efddc54b3

  • SHA512

    55d620d10f9818bb779ea85130e1d4e2827d240d03b6cfe7a5bc97f84bd478941c715e4c54b67671bfba0cd537f6291f18b41cd814f9c2212bee9a223951d475

  • SSDEEP

    768:kcYliTdKUAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:jYIxTAcqOK3qowgnt1d

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de0be96e2f6e851e9839cf839fca7ec86e07d8d745d936c8a8dcbe9efddc54b3.exe
    "C:\Users\Admin\AppData\Local\Temp\de0be96e2f6e851e9839cf839fca7ec86e07d8d745d936c8a8dcbe9efddc54b3.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4904

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Admin.exe
    Filesize

    68KB

    MD5

    c180dbc77ba5f10d67ad6b81e27e79a0

    SHA1

    c443dda3e1794818b69f76029329c67017788fd4

    SHA256

    a45cb0ca742f380179b6a9fdb111424da67eeeca2a535a9f136b4fc04f0b534d

    SHA512

    1c6f82eaac89cc5dcc3bff468f00f4890cc19bb6dd533f757ae92c980eeb220566c5e25acb733fed440729d888ffd765d51587e96c4c0ad8c8c8a9e2c331f965

    Download Submit

  • C:\Users\Admin\Admin.exe
    Filesize

    68KB

    MD5

    c180dbc77ba5f10d67ad6b81e27e79a0

    SHA1

    c443dda3e1794818b69f76029329c67017788fd4

    SHA256

    a45cb0ca742f380179b6a9fdb111424da67eeeca2a535a9f136b4fc04f0b534d

    SHA512

    1c6f82eaac89cc5dcc3bff468f00f4890cc19bb6dd533f757ae92c980eeb220566c5e25acb733fed440729d888ffd765d51587e96c4c0ad8c8c8a9e2c331f965

    Download Submit

  • memory/3124-132-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download

  • memory/4904-135-0x0000000000000000-mapping.dmp

    Download

  • memory/4904-138-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download