Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
01-12-2022 18:57
General
-
Target
b766131149eaaa26fb1153ed2822ea3a731e3e8c00e13a2b74a84992a62861b9.exe
-
Size
142KB
-
MD5
af2816c734d358dae523db1e34cbcb58
-
SHA1
2cde76b99801799bba650a0ce9005ce04862a9f7
-
SHA256
b766131149eaaa26fb1153ed2822ea3a731e3e8c00e13a2b74a84992a62861b9
-
SHA512
d68b1f3f8f0f1b26c6c7ce68fe5127dbca5b02be984102fa398dbce5e725c980ee7ea7230478e51d9a0d2bbd782b77bc3ac25edf474dc868ff62fcd791dcb84a
-
SSDEEP
3072:ScvWJxGpJYVy6It/eCPJkjGta1XsVb7dsqC4wv1hsST:SceJxtI9eChdta1XsVbZXCPfB
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks for any installed AV software in registry 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b766131149eaaa26fb1153ed2822ea3a731e3e8c00e13a2b74a84992a62861b9.exe"C:\Users\Admin\AppData\Local\Temp\b766131149eaaa26fb1153ed2822ea3a731e3e8c00e13a2b74a84992a62861b9.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
316KB
-
Filesize
28KB
-
Filesize
8KB