9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c

General

Target

9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe
Size

1.2MB
MD5

d1c7fe76238790ed77d3aaa87338ec85
SHA1

29b38933a1ce0b5d6b24c2b4bea80e289c2e0680
SHA256

9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c
SHA512

da191169f3b1fe82cb4f72aeb320ce15eb980db37d7b4a096e73cfa75f3fd5ffc7334f7a2c96ae20acf8e87c2db01d31a5d77823604f8eb0beb9766715aa3dda
SSDEEP

24576:cJprrAQMRMKToVk8oksTlEBgJ97QZ1ngmi9sJplXgsR9Q:cJ5rmoVk/ks4ngmi9sJplXgY9Q

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4744	360.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe

Loads dropped DLL 2 IoCs

pid	Process
4744	360.exe
4744	360.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	360.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	360.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	360.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	360.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	360.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4744	360.exe
4744	360.exe
4744	360.exe
4744	360.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 4744	908	9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe	79
PID 908 wrote to memory of 4744	908	9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe	79
PID 908 wrote to memory of 4744	908	9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe	79

C:\Users\Admin\AppData\Local\Temp\9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe
"C:\Users\Admin\AppData\Local\Temp\9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe

Filesize
847KB

MD5
4658235b2fed592550034540004cae66

SHA1
fbc063e961a56eb208b14c87324ba2c487bab08b

SHA256
c6fdda79158c0c6ac99b45e67365725908b94fdbec8913ac0ef0b7a870e30eb0

SHA512
0a72d33fb598ea33680b7da96c57140a7446a5171a29f896d53cde2eab5edef115447bb018275f1b755cc2ac46fecfa2ea9f765cbab2cfaaddd79eb7942eafbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe

Filesize
847KB

MD5
4658235b2fed592550034540004cae66

SHA1
fbc063e961a56eb208b14c87324ba2c487bab08b

SHA256
c6fdda79158c0c6ac99b45e67365725908b94fdbec8913ac0ef0b7a870e30eb0

SHA512
0a72d33fb598ea33680b7da96c57140a7446a5171a29f896d53cde2eab5edef115447bb018275f1b755cc2ac46fecfa2ea9f765cbab2cfaaddd79eb7942eafbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\360verify.dll

Filesize
93KB

MD5
9468d919b3a6d024113d3664698ae17d

SHA1
d5d24f3d49678fb2158440e6237036031444bc32

SHA256
f0658fa84ada335776d5936c5fc6fdad95f40ee0c7b4b1faa3af61e848d9697a

SHA512
81745eb8da3bd4f3d276504838f29b573e217f9a6550d2b50a7ff116b22334bf042abc6d1f0fbf1135abc6276e819a91069b7e81ca9621ed9f34b838e95db55e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\360verify.dll

Filesize
93KB

MD5
9468d919b3a6d024113d3664698ae17d

SHA1
d5d24f3d49678fb2158440e6237036031444bc32

SHA256
f0658fa84ada335776d5936c5fc6fdad95f40ee0c7b4b1faa3af61e848d9697a

SHA512
81745eb8da3bd4f3d276504838f29b573e217f9a6550d2b50a7ff116b22334bf042abc6d1f0fbf1135abc6276e819a91069b7e81ca9621ed9f34b838e95db55e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\LeakCheck.dll

Filesize
341KB

MD5
9e68d584a7e1b30a28ded41b6aa579cf

SHA1
d873112ac0dea660efdd3be2676fc89872075d76

SHA256
ad7e57ddeee403c4089630ebf7c6bc05a4a0e499a8078d676860e043508b3983

SHA512
0b98149bc1797aee111ebd4af2827a954e62d8981630c8f28c90ce9a4efa3391a54e456c999af8a408973db43742c9323f56583b4b118c820aaaad7c7fad0c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\LeakCheck.dll

Filesize
341KB

MD5
9e68d584a7e1b30a28ded41b6aa579cf

SHA1
d873112ac0dea660efdd3be2676fc89872075d76

SHA256
ad7e57ddeee403c4089630ebf7c6bc05a4a0e499a8078d676860e043508b3983

SHA512
0b98149bc1797aee111ebd4af2827a954e62d8981630c8f28c90ce9a4efa3391a54e456c999af8a408973db43742c9323f56583b4b118c820aaaad7c7fad0c5e

Download Submit

Analysis

Sharing