8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e

General

Target

8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe
Size

3.4MB
MD5

8ed572bc057331b9ce5c019ad3990748
SHA1

e9b6261a6803dcd4b83efd6556ffe3d2e4e37486
SHA256

8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e
SHA512

723c0bed17dd467e13d2d7b7f3dd6c94a8ed5afef2e80b0e73ba905dfc899191af78f7e8c80f9f64843674609012e656a3448302f7ab3f9c9f6db250e2e3325f
SSDEEP

98304:6wI89wPuTeaKVaGOjqOeOicO7zLDfgV5l:u8oWkgjqOeOicO7zXa

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4308	updater.exe
3648	SetupAnyDVD6469.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3052-132-0x0000000000400000-0x0000000000590000-memory.dmp	upx
behavioral2/memory/3052-133-0x0000000000400000-0x0000000000590000-memory.dmp	upx
behavioral2/files/0x000700000002319b-139.dat	upx
behavioral2/files/0x000700000002319b-140.dat	upx
behavioral2/memory/3052-141-0x0000000000400000-0x0000000000590000-memory.dmp	upx
behavioral2/memory/3648-142-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3524	4308	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe
3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe
3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe
3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe
3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe
3648	SetupAnyDVD6469.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 4308	3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe	84
PID 3052 wrote to memory of 4308	3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe	84
PID 3052 wrote to memory of 4308	3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe	84
PID 3052 wrote to memory of 3648	3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe	86
PID 3052 wrote to memory of 3648	3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe	86
PID 3052 wrote to memory of 3648	3052	8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe	86

C:\Users\Admin\AppData\Local\Temp\8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe
"C:\Users\Admin\AppData\Local\Temp\8fc23c94d4653cadc175ef99f4bd12b599e77ae7eda2c5b82283ff000d4f238e.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\MMBPlayer\updater.exe
  "C:\Users\Admin\AppData\Local\Temp\MMBPlayer\updater.exe"
  2⤵
  - Executes dropped EXE
  PID:4308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 384
    3⤵
    - Program crash
    PID:3524
- C:\Users\Admin\AppData\Local\Temp\MMBPlayer\SetupAnyDVD6469.exe
  "C:\Users\Admin\AppData\Local\Temp\MMBPlayer\SetupAnyDVD6469.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4308 -ip 4308
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MMBPlayer\SetupAnyDVD6469.exe

Filesize
2.5MB

MD5
5ba468febafbd7f28a6e61c9a811176a

SHA1
1e4915baeca1898ef8f6ac68ecda87ea60886203

SHA256
db31c417c98c5c42b295e74b7e0de9963eb0549431eafbbbd203bb76c5b41e9e

SHA512
5a51b41b6349f3725dc4f8bc38fa92e6618c9932557a2244641b5526dfba237f1763ca0691f1eb2bf0a69b30091857a000528e83528589c27ae630915094d7ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\MMBPlayer\SetupAnyDVD6469.exe

Filesize
2.5MB

MD5
5ba468febafbd7f28a6e61c9a811176a

SHA1
1e4915baeca1898ef8f6ac68ecda87ea60886203

SHA256
db31c417c98c5c42b295e74b7e0de9963eb0549431eafbbbd203bb76c5b41e9e

SHA512
5a51b41b6349f3725dc4f8bc38fa92e6618c9932557a2244641b5526dfba237f1763ca0691f1eb2bf0a69b30091857a000528e83528589c27ae630915094d7ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\MMBPlayer\updater.exe

Filesize
389KB

MD5
5f6abc2ba46e8a3edc2770fe71a9faf2

SHA1
75c08e4333b53f4085a8c7e2f7cd381d80749181

SHA256
33fe6d875282a66ddd6259e380c42c9a4e74777bf307cd697289d6050ead753c

SHA512
ca394b518af4493b080c2dd6f9eabdc524265a423ea0cb7585417d06c9c789b7463fb3acb1478d556679371cf549e1cfc83abd2c84162956e8ade0975b0a13af

Download Submit
C:\Users\Admin\AppData\Local\Temp\MMBPlayer\updater.exe

Filesize
389KB

MD5
5f6abc2ba46e8a3edc2770fe71a9faf2

SHA1
75c08e4333b53f4085a8c7e2f7cd381d80749181

SHA256
33fe6d875282a66ddd6259e380c42c9a4e74777bf307cd697289d6050ead753c

SHA512
ca394b518af4493b080c2dd6f9eabdc524265a423ea0cb7585417d06c9c789b7463fb3acb1478d556679371cf549e1cfc83abd2c84162956e8ade0975b0a13af

Download Submit
memory/3052-132-0x0000000000400000-0x0000000000590000-memory.dmp

Filesize
1.6MB

Download
memory/3052-133-0x0000000000400000-0x0000000000590000-memory.dmp

Filesize
1.6MB

Download
memory/3052-141-0x0000000000400000-0x0000000000590000-memory.dmp

Filesize
1.6MB

Download
memory/3648-142-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4308-137-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4308-143-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing