Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
03-12-2022 18:04
General
-
Target
e6877ebc1d433bd7573e8e38f23054c98ea7f7c5a2deed9d968d0d5140c9eeea.exe
-
Size
36KB
-
MD5
a9d3ab40148aa74e1013e01de78a688d
-
SHA1
7a20322cd61c2901dea98cf5340a42d1af4b6394
-
SHA256
e6877ebc1d433bd7573e8e38f23054c98ea7f7c5a2deed9d968d0d5140c9eeea
-
SHA512
a68e7e27f3f31f83cfa9e2f75a101e57bfaec5406828b0a4ed69d0b114fea639432e3cb041f8ac80e3d6f7e38e76479b53f1273d1dcf8307127effeb311a0f10
-
SSDEEP
384:Db4pRL/W7hiQMB1BYzhyqaORdnZbPgv1:f4pRbW7EQMahyq3Pgv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6877ebc1d433bd7573e8e38f23054c98ea7f7c5a2deed9d968d0d5140c9eeea.exe"C:\Users\Admin\AppData\Local\Temp\e6877ebc1d433bd7573e8e38f23054c98ea7f7c5a2deed9d968d0d5140c9eeea.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\winlogon.exe"C:\Windows\winlogon.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5a9d3ab40148aa74e1013e01de78a688d
SHA17a20322cd61c2901dea98cf5340a42d1af4b6394
SHA256e6877ebc1d433bd7573e8e38f23054c98ea7f7c5a2deed9d968d0d5140c9eeea
SHA512a68e7e27f3f31f83cfa9e2f75a101e57bfaec5406828b0a4ed69d0b114fea639432e3cb041f8ac80e3d6f7e38e76479b53f1273d1dcf8307127effeb311a0f10
-
Filesize
36KB
MD5a9d3ab40148aa74e1013e01de78a688d
SHA17a20322cd61c2901dea98cf5340a42d1af4b6394
SHA256e6877ebc1d433bd7573e8e38f23054c98ea7f7c5a2deed9d968d0d5140c9eeea
SHA512a68e7e27f3f31f83cfa9e2f75a101e57bfaec5406828b0a4ed69d0b114fea639432e3cb041f8ac80e3d6f7e38e76479b53f1273d1dcf8307127effeb311a0f10
-