Analysis
-
max time kernel
171s -
max time network
401s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
03/12/2022, 01:31
General
-
Target
b43665fbbcb7f432d71747e205d51df085f429b232ad1005a4ea7aac82766b2c.exe
-
Size
255KB
-
MD5
c4c74ebabf935baa19f5e12d3359833e
-
SHA1
82376fb1a9255b1903073622e59bc2c57f641ab2
-
SHA256
b43665fbbcb7f432d71747e205d51df085f429b232ad1005a4ea7aac82766b2c
-
SHA512
2c80ed7b1ddf29fa970c3509c2683c3dfa3e077d2a0f5ba093aa7d26dbd45cdf9685907e3a231984789afb1e664c82dac30b70a83ec5c365089bbc8fda861ec3
-
SSDEEP
6144:WjswHa4HKnkvErZCU5Be0VsRoqbxMlm1eRTPDg:Z4HKkvERIKsjDeRvg
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b43665fbbcb7f432d71747e205d51df085f429b232ad1005a4ea7aac82766b2c.exe"C:\Users\Admin\AppData\Local\Temp\b43665fbbcb7f432d71747e205d51df085f429b232ad1005a4ea7aac82766b2c.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\keygen.exe"C:\Users\Admin\AppData\Roaming\keygen.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\303443_2599185bace0bbd1b9f92e7e3e719737.exe"C:\Users\Admin\AppData\Roaming\303443_2599185bace0bbd1b9f92e7e3e719737.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129KB
MD52599185bace0bbd1b9f92e7e3e719737
SHA136367008a3074d344d2f1e4c457e9c5d4b188a0c
SHA2563449e496b012e271e7dc6d3bd9b2bf5ca0c85c8ebe75d4d3e2b2ab48411945d8
SHA512195a1d34415c65829d7cc593b9db0569b32bd289e36b3082a903c7378d5ad790b52868fa41bf74bc7382690a9a756a299925a9cd3beb2262ddec0276419736e2
-
Filesize
129KB
MD52599185bace0bbd1b9f92e7e3e719737
SHA136367008a3074d344d2f1e4c457e9c5d4b188a0c
SHA2563449e496b012e271e7dc6d3bd9b2bf5ca0c85c8ebe75d4d3e2b2ab48411945d8
SHA512195a1d34415c65829d7cc593b9db0569b32bd289e36b3082a903c7378d5ad790b52868fa41bf74bc7382690a9a756a299925a9cd3beb2262ddec0276419736e2
-
Filesize
79KB
MD54cab60b6428608b76dbe0f1f12b6cc02
SHA1964922c9cfa4df9059aa2090ccadecd30b8d9d4f
SHA256be741f127a0be9bd8796ffddb6b29a4d907aaf2e895bbf6a3e74e6648896f7cb
SHA5120072c8882c6f00cef014536be749dbf5cbceaebd1ce4b73635cf12ba9aac66b3ff1e8a532f2f35bbca501cbd66caca6caac6bbb9a419758c26d784640074682d
-
Filesize
79KB
MD54cab60b6428608b76dbe0f1f12b6cc02
SHA1964922c9cfa4df9059aa2090ccadecd30b8d9d4f
SHA256be741f127a0be9bd8796ffddb6b29a4d907aaf2e895bbf6a3e74e6648896f7cb
SHA5120072c8882c6f00cef014536be749dbf5cbceaebd1ce4b73635cf12ba9aac66b3ff1e8a532f2f35bbca501cbd66caca6caac6bbb9a419758c26d784640074682d
-
Filesize
132KB
-
Filesize
10.2MB