ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe
Size

393KB
MD5

1156b80d7c68bae38af88ecf13d3dc82
SHA1

fb1516b53adb0033c2fbe444c998990ec5a45e69
SHA256

ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d
SHA512

e6be56c6f650a4e77130f99bb92d822548123d92243631b1c08e5073b560de0c8cd6abe86961e3ad85a43dc5fc97f6e084723bba277f07f005e5aa3a3537f9ce
SSDEEP

6144:fhUxwUcIzRmQniqTHVt5q2SG8Q/peqLxQM1qgFI/z0XY76i1Qxt9Kok:uSK1m1qT1nq2drpnxQM1qgFI/szg9z

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4744	installer.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4996-132-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4996-136-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4744	4996	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe	81
PID 4996 wrote to memory of 4744	4996	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe	81
PID 4996 wrote to memory of 4744	4996	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe	81

C:\Users\Admin\AppData\Local\Temp\ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe
"C:\Users\Admin\AppData\Local\Temp\ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe"
  2⤵
  - Executes dropped EXE
  PID:4744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

Filesize
1.3MB

MD5
273b8bb8a29b24de7e664189e707b1e6

SHA1
18fbc8e40924df9a49b590acf419b26109415301

SHA256
a14c7fdc2ff52e679352176579b7cea8b94352b70b0cec51cba0d05881c10c2e

SHA512
d1976d37395728b6649e4a4d90bfe5a33b3dfafd36ff31ea6c77b5e513f667baa4d43d93465dc006ecca19e8639967974d5a7cc80127b5ca01112510b0b5a498

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

Filesize
1.3MB

MD5
273b8bb8a29b24de7e664189e707b1e6

SHA1
18fbc8e40924df9a49b590acf419b26109415301

SHA256
a14c7fdc2ff52e679352176579b7cea8b94352b70b0cec51cba0d05881c10c2e

SHA512
d1976d37395728b6649e4a4d90bfe5a33b3dfafd36ff31ea6c77b5e513f667baa4d43d93465dc006ecca19e8639967974d5a7cc80127b5ca01112510b0b5a498

Download Submit
memory/4996-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4996-136-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download