Analysis

  • max time kernel
    152s
  • max time network
    194s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2022 03:20

General

  • Target

    4f5cf2d4b49443dcdb8db5b32adaf1f218e692866257887224a52ae39e3676df.exe

  • Size

    100KB

  • MD5

    03e9d31fe2f7b376c48b316e4b09ce3b

  • SHA1

    6dd978096e2ac309782cec308f10871bbfbf16a9

  • SHA256

    4f5cf2d4b49443dcdb8db5b32adaf1f218e692866257887224a52ae39e3676df

  • SHA512

    d90226b08f0f80c9710ba26ac72bae12453554798531e4acc195c3c32b228a72a299f6810610783404f0654b8a2249ff184ed4ed9ee0f20e2d1ca1d31a88737e

  • SSDEEP

    1536:jwWbcX220mQjVxJKIRGWcOUP7vXArnY1ZqAefzyesdNIjnZjJ:kPQjQNAfzye6CnRJ

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 46 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f5cf2d4b49443dcdb8db5b32adaf1f218e692866257887224a52ae39e3676df.exe
    "C:\Users\Admin\AppData\Local\Temp\4f5cf2d4b49443dcdb8db5b32adaf1f218e692866257887224a52ae39e3676df.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Users\Admin\koiep.exe
      "C:\Users\Admin\koiep.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2652

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\koiep.exe

    Filesize

    100KB

    MD5

    45109241c965f30b21a484b2074b2dc3

    SHA1

    5136b4092eed749588433827439edb9b2c5dc1d2

    SHA256

    ccdc41472895d197715d376885937730efb5995c6b2ceb9eed1275cf08e2dd88

    SHA512

    92c398e822cbdc471201eb9777b7fd45aa18ab21c4c14076ca38e45d84f92ea17841c8c97784f1ea62b4700325281f498a0968bf89d68407f1d1312ff5891ef1

  • C:\Users\Admin\koiep.exe

    Filesize

    100KB

    MD5

    45109241c965f30b21a484b2074b2dc3

    SHA1

    5136b4092eed749588433827439edb9b2c5dc1d2

    SHA256

    ccdc41472895d197715d376885937730efb5995c6b2ceb9eed1275cf08e2dd88

    SHA512

    92c398e822cbdc471201eb9777b7fd45aa18ab21c4c14076ca38e45d84f92ea17841c8c97784f1ea62b4700325281f498a0968bf89d68407f1d1312ff5891ef1

  • memory/2652-134-0x0000000000000000-mapping.dmp