88a2283fba201d5d09bd026de6129fba59eef1c876f080fab06d4d9d33119077

Analysis

max time kernel
211s
max time network
230s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88a2283fba201d5d09bd026de6129fba59eef1c876f080fab06d4d9d33119077.exe
Size

675KB
MD5

f27d04ee45dc7d820855f40f102a8007
SHA1

b1b97a93c06bb00456ac7d2f7d375dcd1be5491c
SHA256

88a2283fba201d5d09bd026de6129fba59eef1c876f080fab06d4d9d33119077
SHA512

a716ede0974859d8751b840f66de3dd4a0126877ad0d7f46b20278159839ea4a040807d95a7af0fe8a17cffd9df4c9e18b93d06900a1b81627b88f2efaefd716
SSDEEP

12288:OJEg2DXL6wbGs8601c6qwkvt2BE6FVJtLCVcYi1po0v41CuMr:a2D76W01cbwkV2PJsVczpTWy

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
220	KinpleSetup_p058.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4836-132-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/files/0x0008000000023199-134.dat	upx
behavioral2/files/0x0008000000023199-135.dat	upx
behavioral2/memory/220-136-0x0000000000400000-0x00000000005EE000-memory.dmp	upx
behavioral2/memory/4836-137-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/220-138-0x0000000000400000-0x00000000005EE000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	88a2283fba201d5d09bd026de6129fba59eef1c876f080fab06d4d9d33119077.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 220	4836	88a2283fba201d5d09bd026de6129fba59eef1c876f080fab06d4d9d33119077.exe	80
PID 4836 wrote to memory of 220	4836	88a2283fba201d5d09bd026de6129fba59eef1c876f080fab06d4d9d33119077.exe	80
PID 4836 wrote to memory of 220	4836	88a2283fba201d5d09bd026de6129fba59eef1c876f080fab06d4d9d33119077.exe	80

C:\Users\Admin\AppData\Local\Temp\88a2283fba201d5d09bd026de6129fba59eef1c876f080fab06d4d9d33119077.exe
"C:\Users\Admin\AppData\Local\Temp\88a2283fba201d5d09bd026de6129fba59eef1c876f080fab06d4d9d33119077.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\KinpleSetup_p058.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\KinpleSetup_p058.exe"
  2⤵
  - Executes dropped EXE
  PID:220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\KinpleSetup_p058.exe

Filesize
482KB

MD5
3deccb719b7910e2fa88c8a8f2ce4bef

SHA1
64aef84b7221be78c31406dd115e0c47fe57ef36

SHA256
76beb54f95ede6023420e916a47c1ad69a87d940b4b663e63f4a6f7b0d989689

SHA512
247f9177e9051b48f7dcbcc58cea0fc40a8581403e2afaa11c45d9138fa4b79e7b20af320c2216e5f465508e64260c763aabd1863165481514017b6e635774d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\KinpleSetup_p058.exe

Filesize
482KB

MD5
3deccb719b7910e2fa88c8a8f2ce4bef

SHA1
64aef84b7221be78c31406dd115e0c47fe57ef36

SHA256
76beb54f95ede6023420e916a47c1ad69a87d940b4b663e63f4a6f7b0d989689

SHA512
247f9177e9051b48f7dcbcc58cea0fc40a8581403e2afaa11c45d9138fa4b79e7b20af320c2216e5f465508e64260c763aabd1863165481514017b6e635774d0

Download Submit
memory/220-136-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/220-138-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/4836-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4836-137-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download