Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 16:52

General

  • Target

    ea5367f72b81698c8434adf2b3b1eb6d16377261df346fcb852231b2061238fe.exe

  • Size

    204KB

  • MD5

    bc15713ad81d65aeefda6686de5320b2

  • SHA1

    f71335458adffa8344f1d93ff19ed103e5f37b02

  • SHA256

    ea5367f72b81698c8434adf2b3b1eb6d16377261df346fcb852231b2061238fe

  • SHA512

    0c92d544b182453691798b5e42502c37b48b193570e7077012d777ee5a32b3c69d3b7655fbeb7235cc24051b98d138634936bbd0efc42c5ff3df4c7e0f8f46a8

  • SSDEEP

    3072:GmmFW8t0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWDCr:kUK4QxL7B9W0c1RCzR/fSml4C

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea5367f72b81698c8434adf2b3b1eb6d16377261df346fcb852231b2061238fe.exe
    "C:\Users\Admin\AppData\Local\Temp\ea5367f72b81698c8434adf2b3b1eb6d16377261df346fcb852231b2061238fe.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Users\Admin\mumem.exe
      "C:\Users\Admin\mumem.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2076

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\mumem.exe

    Filesize

    204KB

    MD5

    6b6405543e75b4992010ba945ae9448e

    SHA1

    26aca2a1c057baa6ddd5bf9c1064a89eafb444af

    SHA256

    2ff3fe1af651f0b3f92a5ec6c5b956eb33cd2883245d2b1a2d426c764ddded32

    SHA512

    0483bed5076b4e6fb1ddb3b7b67ab8cba7a4fd48948368181fd1b0bad718cfbb9edd83ad92714d53a39a00488f7344243acb023886624dd183a76b126adaa6d5

  • C:\Users\Admin\mumem.exe

    Filesize

    204KB

    MD5

    6b6405543e75b4992010ba945ae9448e

    SHA1

    26aca2a1c057baa6ddd5bf9c1064a89eafb444af

    SHA256

    2ff3fe1af651f0b3f92a5ec6c5b956eb33cd2883245d2b1a2d426c764ddded32

    SHA512

    0483bed5076b4e6fb1ddb3b7b67ab8cba7a4fd48948368181fd1b0bad718cfbb9edd83ad92714d53a39a00488f7344243acb023886624dd183a76b126adaa6d5