Analysis
- max time kernel
199s - max time network
205s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
27/11/2022, 19:00
Static task
static1
Behavioral task
behavioral1
Sample
ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe
- Size 68KB
- Sample221127-xnpnfsbc77
- SHA256 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4
- MD5 f738b21b6af3a72f1d5d80e9c638c3c5
- SHA1 94fedb77203e8127b1a5d18cad2e21cd64252416
- SHA512 10684938a95067cc9197bbb6e6c4a692a37647382b3672605cdbf05028b481285777c22c33e6d9d9b393205d3c1511d40863b74a7ff77a5c8d61136d271ce183
- SSDEEP 768:Ec5qliTdaIAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:DIIxnAcqOK3qowgnt1d
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Admin.exe - Executes dropped EXE 1 IoCs
pid Process 4496 Admin.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" Admin.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Admin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe 4496 Admin.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 4496 Admin.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1128 wrote to memory of 4496 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 83 PID 1128 wrote to memory of 4496 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 83 PID 1128 wrote to memory of 4496 1128 ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe"C:\Users\Admin\AppData\Local\Temp\ed32d6fd44a6306c578bf2f3c51f7c92d8b5f24206b6dbe7a486b94d67f281d4.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4496
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Admin.exe
- Size 68KB
- SHA256 ad6a78bd1bf1f27b30cf641bb368e067e3158766410f317e82f2e1505011ed62
- MD5 eaf6baf10ab6b2f78db8ecf8e96cdde3
- SHA1 d1cd7372d78e94150ff4783b255123f7c4bb2fd9
- SHA512 fad0c10fff3034bb58d7edebab402cae64d678d48ce09061e0471442554778a0a2b037d24f94f8d1c84adddde94da99671fd2f2fbdb218b5cdacd77778e59186
- SSDEEP 768:EcZqliTda+Al+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:DZqIxRAcqOK3qowgnt1d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Admin.exe
- Size 68KB
- SHA256 ad6a78bd1bf1f27b30cf641bb368e067e3158766410f317e82f2e1505011ed62
- MD5 eaf6baf10ab6b2f78db8ecf8e96cdde3
- SHA1 d1cd7372d78e94150ff4783b255123f7c4bb2fd9
- SHA512 fad0c10fff3034bb58d7edebab402cae64d678d48ce09061e0471442554778a0a2b037d24f94f8d1c84adddde94da99671fd2f2fbdb218b5cdacd77778e59186
- SSDEEP 768:EcZqliTda+Al+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:DZqIxRAcqOK3qowgnt1d
- MD5 SHA1 SHA512 SSDEEP