Analysis
-
max time kernel
383s -
max time network
421s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
29-11-2022 04:35
Errors
General
-
Target
Arc Symbolic.exe
-
Size
2.0MB
-
MD5
bb9c115236bc0cfc50b5a587502b5ce2
-
SHA1
996d297d64f2969db9b91d88348117500ca562ef
-
SHA256
c1cd934805c70b710c62651286374e5804ad85be6c354235fd9b66ac417706bb
-
SHA512
7040a328580c839681e7e6230617e92fd7c8a2e873d78280f1e916bce05c6068852d5e7a27dd8bc09c3be2158e0a43a956c0261246bbcabd7dc5b8f7e0dfcfbb
-
SSDEEP
49152:1rfCnwTCcIuWP31YMLpcnE3hnuyThujvzzHsDizvd:0wTCcIuWP31YMpRnTeHsDi5
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Program Files directory 25 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 15 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Arc Symbolic.exe"C:\Users\Admin\AppData\Local\Temp\Arc Symbolic.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Arc Symbolic\iPack_Installer.exe"C:\Program Files (x86)\Arc Symbolic\iPack_Installer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Arc Symbolic\7z.exe"C:\Program Files (x86)\Arc Symbolic\7z.exe" x -y -bd "C:\Program Files (x86)\Arc Symbolic\Resource.7z"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3994855 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD5f3d2f74e271da7fa59d9a4c860e6f338
SHA196e9fa8808fbe176494a624b4a7b5afc9306f93a
SHA256d2c632a87f70039f8812f0bd5602379e288bfac237b0fce41cb5d8c757c70be3
SHA5121553ba5d27ef59015ee4ff05e37d79a3da5d2257de193e61800f587917dbc5ba97e1d499448b41e370962b977570a4ea1c936e791d886e71384edaba39d5fe30
-
Filesize
148KB
MD5f3d2f74e271da7fa59d9a4c860e6f338
SHA196e9fa8808fbe176494a624b4a7b5afc9306f93a
SHA256d2c632a87f70039f8812f0bd5602379e288bfac237b0fce41cb5d8c757c70be3
SHA5121553ba5d27ef59015ee4ff05e37d79a3da5d2257de193e61800f587917dbc5ba97e1d499448b41e370962b977570a4ea1c936e791d886e71384edaba39d5fe30
-
Filesize
1005KB
MD5aabb74f35e233e43077676cf47fa4d77
SHA17314da4c8b2ffaa6f48d07667a16c106df70f9c1
SHA25632e1fd9aa2d07bc9458e788e86ab6f6f9d65c4b6d9890f32f6a4c9fce53f20c0
SHA512fdb8b58f2e58f55cf1a12b017b1ef97ba239c74dc7662053e6204604bffb0ce1230d5a50042e08525bb8e55917aa6a71e15fdaae7e71ffb8f27cfa25a1d0b815
-
Filesize
1005KB
MD53d009005cfe1791809f9e632af223302
SHA18336af02d7ad736082b7ccc823b537e31da0b0b1
SHA25628dacd413b33d3077ef6331fa1df8314a91b19dcc41712e561b3485a3a154da3
SHA5120bbf27ed24fdf03234ec60d62596202d1610c3e5499cff2338ad2824cd11348966cd11a3f94bdcd320ba70731b90340b44c339511e81b44036583d89bb153767
-
Filesize
229B
MD51c63e96e2999e643c126741e422594f4
SHA11e7f84c29d0446f5a061a837de1b19fdb29a54f2
SHA2566eb25a598d70ed6ce3334ef31c1ee9323e0b33d2036d84e32b29e7b87df86f2f
SHA512dc9d87102140c6934099827b00801ad40fb13f16443214e2e91293c8472044d2f76d56e97be288b8af3b2d55b430761e0d4a312088f9f0ac45a43ee9e16d5c66
-
Filesize
938B
MD57c7ef0ea0aee71277f40ea6228aa0942
SHA12f808a4116dbe65a55d19bd96bf0268e2e19bc2c
SHA256fc5dcb8d80c94a002cd6f48dc502bd68ea833e918083b2881e86bba99ad2f7ea
SHA512bac83e2375c09f4e822267b9f91933e5dbf91705ecd322161b951e44e76b88e9ff3ccc45ba401e8c561dc04e3ca64e3259c7eb096a2a3df4a41b7da5cea26149
-
Filesize
21KB
MD521da3154a1bc6d1d582ba74191f6756e
SHA12e48ce7cc1c888d2525750200e6dd21c14b7f59c
SHA256dea6f44854346692fc183119abed2de5848cadd47aa32d953a0b78ffa2a1868e
SHA512eb169f932b0741803f8f8d6adfac3253f86f57e103e8512d4da53775cca0d344fab8a83313c9014464d581210131b27c2170d1b198a17318c1090239a860d7b6
-
Filesize
1.2MB
MD52d3893786a56f90d7ec618e1f12a5f26
SHA109cd9d0ba3118a5fcad652e80c63a39b8f232ab4
SHA256764b45b79a0e6834bbfe8855281ceae0eb1a454d1a3f2dd0c28db2441a4a26c0
SHA512b5a74f54b9b2eb94b864d5d04e4ccff7c476392c97c87d7594f276ade132b07a0e62fcca50248a2233b146a0001b70c62ba46e9f732970f411483206185e1ceb
-
Filesize
1.2MB
MD52d3893786a56f90d7ec618e1f12a5f26
SHA109cd9d0ba3118a5fcad652e80c63a39b8f232ab4
SHA256764b45b79a0e6834bbfe8855281ceae0eb1a454d1a3f2dd0c28db2441a4a26c0
SHA512b5a74f54b9b2eb94b864d5d04e4ccff7c476392c97c87d7594f276ade132b07a0e62fcca50248a2233b146a0001b70c62ba46e9f732970f411483206185e1ceb
-
Filesize
171B
MD5cb143eef30f7ad481e715926b63928f4
SHA14bb8ae8914d07d475c4c5bbf97abfa8c60544e00
SHA2566105a59eaa1401813a363239fb193a79179d3abc93abc4f65f180e60770b6e17
SHA512e3067b72b255772a73d8ea4564e4874008fb52de9e18cfcdfda547408288826629f1f2ce7c0efb07b9528d34e0efd0635b91560df50f12edd4b5c19cef5af19d
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
360KB
-
Filesize
360KB
-
-
Filesize
20KB
-
Filesize
10.2MB
-
-
Filesize
20KB
-
Filesize
20KB
