Analysis
-
max time kernel
158s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
04/12/2022, 04:50
General
-
Target
a8e9e123c622307cb4e69aa7f3b8a7b45489172299fe04d351e36d5c8f8490d1.exe
-
Size
706KB
-
MD5
8c1a051747bc7a8211593014e98ea036
-
SHA1
0cc3bdc4b9d492289a721c6f99657bd9e5c1cfd4
-
SHA256
a8e9e123c622307cb4e69aa7f3b8a7b45489172299fe04d351e36d5c8f8490d1
-
SHA512
7d4d4d1f1d57abc13e506c4ae3db32475478fa1f1fcf90128ba6a8e938e85970967208182463b7b2b0b9d42f816a68f71cbea4c0e5ebfb2d6f1318b0491772cf
-
SSDEEP
12288:gp/iN/mlVdtvrYeyZJf7kPK+iqBZn+D73iKHeGspZaaQhBLuCffYH0r/wDetam:gpQ/6trYlvYPK+lqD73TeGspA7ByWMm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8e9e123c622307cb4e69aa7f3b8a7b45489172299fe04d351e36d5c8f8490d1.exe"C:\Users\Admin\AppData\Local\Temp\a8e9e123c622307cb4e69aa7f3b8a7b45489172299fe04d351e36d5c8f8490d1.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\ScrBlaze.scr"C:\Windows\ScrBlaze.scr" /S2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706KB
MD58c1a051747bc7a8211593014e98ea036
SHA10cc3bdc4b9d492289a721c6f99657bd9e5c1cfd4
SHA256a8e9e123c622307cb4e69aa7f3b8a7b45489172299fe04d351e36d5c8f8490d1
SHA5127d4d4d1f1d57abc13e506c4ae3db32475478fa1f1fcf90128ba6a8e938e85970967208182463b7b2b0b9d42f816a68f71cbea4c0e5ebfb2d6f1318b0491772cf
-
Filesize
706KB
MD58c1a051747bc7a8211593014e98ea036
SHA10cc3bdc4b9d492289a721c6f99657bd9e5c1cfd4
SHA256a8e9e123c622307cb4e69aa7f3b8a7b45489172299fe04d351e36d5c8f8490d1
SHA5127d4d4d1f1d57abc13e506c4ae3db32475478fa1f1fcf90128ba6a8e938e85970967208182463b7b2b0b9d42f816a68f71cbea4c0e5ebfb2d6f1318b0491772cf
-
Filesize
976B
MD514dff3fa3898a053f93e169ac7c94992
SHA1f18a0bd87dde27405681a57f7522a97f23ca5cea
SHA256325de47082b038196a7bd57665cdcbd03c29203d58d57f56f3f7594bc49391b3
SHA51298a11b61b15e13090153e732b1ff80a2a84f5aca651a98b353e872e31f8d87b3a319b44e51c4f1f016369c5b382f4cefde4620dff63c296c40fb1eeac2a13d60