Analysis
-
max time kernel
169s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
01-12-2022 03:13
General
-
Target
7717ea363cdbc6b37caacdd8cdc3811ef1ff6d655d478f35660bb4d4cec630a6.exe
-
Size
592KB
-
MD5
95d09778f050d8bcc5805b4c56200d55
-
SHA1
8dac4eb7d51df65fd6ac81dd1e906c674b363d95
-
SHA256
7717ea363cdbc6b37caacdd8cdc3811ef1ff6d655d478f35660bb4d4cec630a6
-
SHA512
0c41173e611725249f611fb362668d5cc64cc4a24c3ff4d32fde88f9784896c449d1939a46c9b9fcd9365b8942085dc7f807392207c0da5ed45a8f69174a8d54
-
SSDEEP
12288:zK2mhAMJ/cPl+vnGEhP4ltXEv/lL6TC84wzFYA/dEJf8uYHIA8lsT:22O/Gl+vnbpIElL4NFYJp8uY7oS
Malware Config
Signatures
-
UAC bypass 3 TTPs 2 IoCs
-
Executes dropped EXE 7 IoCs
-
Modifies Windows Firewall 1 TTPs 3 IoCs
-
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7717ea363cdbc6b37caacdd8cdc3811ef1ff6d655d478f35660bb4d4cec630a6.exe"C:\Users\Admin\AppData\Local\Temp\7717ea363cdbc6b37caacdd8cdc3811ef1ff6d655d478f35660bb4d4cec630a6.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tashfer.exe"C:\Users\Admin\AppData\Local\Temp\tashfer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\tashferkraw.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\tashferkraw.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\explorerx.exe"C:\Users\Admin\AppData\Local\Temp\explorerx.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"5⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\explorer.exe"C:\ProgramData\explorer.exe"6⤵
- UAC bypass
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\ProgramData\explorer.exe" "explorer.exe" ENABLE7⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\SysWOW64\wscript.exe" "wscript.exe" ENABLE7⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe" "C:\ProgramData\explorer.vbe"7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"5⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE6⤵
- Modifies Windows Firewall
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD59c52b1d644fbd3d76716c9c3dee3d42c
SHA19a7e41669f88d46d2382116698da4faed9a83942
SHA256dc6013f6a886595a5f3f12f978f968e19be14bac2cca587ad7b6c17aecc98091
SHA5120c2d285040627284dca6ba45acf70d0a392e428770b2bc9e39ad1df06ba097dd7820626850fe4dcf6fcd8348bb840431716373b70d4221c5d9c0eab701bf6a43
-
Filesize
250KB
MD59c52b1d644fbd3d76716c9c3dee3d42c
SHA19a7e41669f88d46d2382116698da4faed9a83942
SHA256dc6013f6a886595a5f3f12f978f968e19be14bac2cca587ad7b6c17aecc98091
SHA5120c2d285040627284dca6ba45acf70d0a392e428770b2bc9e39ad1df06ba097dd7820626850fe4dcf6fcd8348bb840431716373b70d4221c5d9c0eab701bf6a43
-
Filesize
54B
MD53e2daf38e0ae3e4cb752ba07e317ab8a
SHA1403119ccb6060f1663057c0ee723d669090f227d
SHA256368663c0c1ad3ea27349893d950a8f851260fd5cf5b8ad796f801afb513167e1
SHA512284ba94b51771ffb8e1636e00968f8b5d217b5f6dc66ab2ed7c4394cf920f174a6cc5375da497270b13738f8a4efdc1f75a319dbc7dc7fd7850eb86ef937587b
-
Filesize
353KB
MD5c3aa4d3d7ad17e5aa878b2843ba5b678
SHA1b7dd472080977433b6c19f49ddc169015a9338ba
SHA256ac46ac55dbff390438d38b766775cc6be7e24787c7a077037ed0e82d68f758bf
SHA512d4dbc272d26fe07119df7bd3b25057bde1cd66c2208634040ba4ec454cb9a5c565a1006538790cf99f71853f4407b1fd5f395af3086ef2d466b3c64196f1eb92
-
Filesize
353KB
MD5c3aa4d3d7ad17e5aa878b2843ba5b678
SHA1b7dd472080977433b6c19f49ddc169015a9338ba
SHA256ac46ac55dbff390438d38b766775cc6be7e24787c7a077037ed0e82d68f758bf
SHA512d4dbc272d26fe07119df7bd3b25057bde1cd66c2208634040ba4ec454cb9a5c565a1006538790cf99f71853f4407b1fd5f395af3086ef2d466b3c64196f1eb92
-
Filesize
26KB
MD5e75115f6d21f2e9fb32b99581fa78c72
SHA1ced1632142bb27e10d711b788a042e4f0e76a0d7
SHA256968d1be7df46e4859bf69f00d6f6c633cd8b8cd43ec3bdfd60c137868db8d24d
SHA5124ec9f10bd07a92f261f1533234a7c34082656592bd8c5724faa6380055f67e8992a599fcb155522c8f1515f71e380756ccfc44889f44dcb819f9928d65f89171
-
Filesize
26KB
MD5e75115f6d21f2e9fb32b99581fa78c72
SHA1ced1632142bb27e10d711b788a042e4f0e76a0d7
SHA256968d1be7df46e4859bf69f00d6f6c633cd8b8cd43ec3bdfd60c137868db8d24d
SHA5124ec9f10bd07a92f261f1533234a7c34082656592bd8c5724faa6380055f67e8992a599fcb155522c8f1515f71e380756ccfc44889f44dcb819f9928d65f89171
-
Filesize
26KB
MD5e75115f6d21f2e9fb32b99581fa78c72
SHA1ced1632142bb27e10d711b788a042e4f0e76a0d7
SHA256968d1be7df46e4859bf69f00d6f6c633cd8b8cd43ec3bdfd60c137868db8d24d
SHA5124ec9f10bd07a92f261f1533234a7c34082656592bd8c5724faa6380055f67e8992a599fcb155522c8f1515f71e380756ccfc44889f44dcb819f9928d65f89171
-
Filesize
26KB
MD5e75115f6d21f2e9fb32b99581fa78c72
SHA1ced1632142bb27e10d711b788a042e4f0e76a0d7
SHA256968d1be7df46e4859bf69f00d6f6c633cd8b8cd43ec3bdfd60c137868db8d24d
SHA5124ec9f10bd07a92f261f1533234a7c34082656592bd8c5724faa6380055f67e8992a599fcb155522c8f1515f71e380756ccfc44889f44dcb819f9928d65f89171
-
Filesize
250KB
MD59c52b1d644fbd3d76716c9c3dee3d42c
SHA19a7e41669f88d46d2382116698da4faed9a83942
SHA256dc6013f6a886595a5f3f12f978f968e19be14bac2cca587ad7b6c17aecc98091
SHA5120c2d285040627284dca6ba45acf70d0a392e428770b2bc9e39ad1df06ba097dd7820626850fe4dcf6fcd8348bb840431716373b70d4221c5d9c0eab701bf6a43
-
Filesize
250KB
MD59c52b1d644fbd3d76716c9c3dee3d42c
SHA19a7e41669f88d46d2382116698da4faed9a83942
SHA256dc6013f6a886595a5f3f12f978f968e19be14bac2cca587ad7b6c17aecc98091
SHA5120c2d285040627284dca6ba45acf70d0a392e428770b2bc9e39ad1df06ba097dd7820626850fe4dcf6fcd8348bb840431716373b70d4221c5d9c0eab701bf6a43
-
Filesize
268KB
MD596ceea2acd93638d4cec8c36508f922c
SHA1451526952b16dc0ff2797b74fa58619b88b1db11
SHA25608c952c3ba627104a0068d45d2f79cd9a2d91c199038d41080c8028548edb2b5
SHA51276e124ab3249d49762b0ddc3e5d30aaa921ad76914716b1be9749628d16ef3a823ae305873813e11c6949b8c0ab6de59f9f675c3bcadaed87b559e532bcd18e6
-
Filesize
268KB
MD596ceea2acd93638d4cec8c36508f922c
SHA1451526952b16dc0ff2797b74fa58619b88b1db11
SHA25608c952c3ba627104a0068d45d2f79cd9a2d91c199038d41080c8028548edb2b5
SHA51276e124ab3249d49762b0ddc3e5d30aaa921ad76914716b1be9749628d16ef3a823ae305873813e11c6949b8c0ab6de59f9f675c3bcadaed87b559e532bcd18e6
-
Filesize
573KB
MD51fd3abc9e4234338b2a6b1ed301eb7de
SHA13057d24befa9d9408226f7ef16aeed3d935e5913
SHA25687a7fa8dfd05f190e051f62c52005d14c4b4073f5ea7510d250dc8554955c28d
SHA512d1c93ff0d9b2e5903f0606a276edd2d9d003ffb5771f15fd3953a016a6b8423631e39a1e6a932ac686b0300ace94697c3d2177e6fd57f8fb8f4459fb9dad662e
-
Filesize
573KB
MD51fd3abc9e4234338b2a6b1ed301eb7de
SHA13057d24befa9d9408226f7ef16aeed3d935e5913
SHA25687a7fa8dfd05f190e051f62c52005d14c4b4073f5ea7510d250dc8554955c28d
SHA512d1c93ff0d9b2e5903f0606a276edd2d9d003ffb5771f15fd3953a016a6b8423631e39a1e6a932ac686b0300ace94697c3d2177e6fd57f8fb8f4459fb9dad662e
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
5.7MB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
5.7MB
-
Filesize
280KB
-
Filesize
5.7MB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
10.2MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB