Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2022 02:06

General

  • Target

    15daea6f00191a6fafd7dc8692669252c4e1080e548c1971dc68edc4c319a84c.exe

  • Size

    272KB

  • MD5

    68f8cdab7dd87128507520dd35387736

  • SHA1

    3a8eb6347446e1f1c912c46bf438dd707a9d85a6

  • SHA256

    15daea6f00191a6fafd7dc8692669252c4e1080e548c1971dc68edc4c319a84c

  • SHA512

    cf21f227467c73af52930f9c5e68019b5894459439c2e0eba75f964dc266c5a3830b153a7369857441d7c7cdd89d65ae1003fe6b16c00b0f774fbe1624ad3151

  • SSDEEP

    3072:NRyM68NgtWHzaqBtmKOqNRkQUG7opA83KPj/1yBFfJp1m:TyM6yHt66i3pAGKPj/1yB9j1m

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15daea6f00191a6fafd7dc8692669252c4e1080e548c1971dc68edc4c319a84c.exe
    "C:\Users\Admin\AppData\Local\Temp\15daea6f00191a6fafd7dc8692669252c4e1080e548c1971dc68edc4c319a84c.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Users\Admin\miiuxer.exe
      "C:\Users\Admin\miiuxer.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2580

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\miiuxer.exe

    Filesize

    272KB

    MD5

    ec62abbcb1493f5e6bab0419a6221ffc

    SHA1

    2693b2adf0f7a5771f9e60d41384c4348f6aa8ae

    SHA256

    2841c8d205f56b44aed2cfbc309dbec4a08a44f29803d1957c217c93d6cbf606

    SHA512

    e298965a3101ab7928bd5479a76662add886a0d4ed270c89afb26f547252281052d41e57662cd11bfe84975252cb8117219a4da029c1f0e74af8ed8f44965b30

  • C:\Users\Admin\miiuxer.exe

    Filesize

    272KB

    MD5

    ec62abbcb1493f5e6bab0419a6221ffc

    SHA1

    2693b2adf0f7a5771f9e60d41384c4348f6aa8ae

    SHA256

    2841c8d205f56b44aed2cfbc309dbec4a08a44f29803d1957c217c93d6cbf606

    SHA512

    e298965a3101ab7928bd5479a76662add886a0d4ed270c89afb26f547252281052d41e57662cd11bfe84975252cb8117219a4da029c1f0e74af8ed8f44965b30