Overview

overview

8

Static

static

aa89030c3d...98.exe

windows7-x64

8

aa89030c3d...98.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    208s
  • max time network
    203s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 23:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    aa89030c3d95d51af183c5d60f5e9e1e9622cb956155e7b38e45f5e5bcc0ac98.exe

  • Size

    115KB

  • MD5

    dd4d7fff0c01b9965cf254e918721948

  • SHA1

    ab0411ffa26efd9b48bc479ac9964ff0ceffa319

  • SHA256

    aa89030c3d95d51af183c5d60f5e9e1e9622cb956155e7b38e45f5e5bcc0ac98

  • SHA512

    591cf5af868a58ff04df9117fd9f0ae67aca953c67d89ddfd5a5fb82eed34684976ee78ef3754b9ca7b63d12dec1de368f210b0a2a7500538791607b1a487c7f

  • SSDEEP

    1536:OAwWU+hDA5bTxzoOaxbovYXr+blAPxZEy2eZPyXEDgPt8JSZ/IYm4c:2WzhM5bTxzWxbov4PPvEmPJDgWJSNBc

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa89030c3d95d51af183c5d60f5e9e1e9622cb956155e7b38e45f5e5bcc0ac98.exe
    "C:\Users\Admin\AppData\Local\Temp\aa89030c3d95d51af183c5d60f5e9e1e9622cb956155e7b38e45f5e5bcc0ac98.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Users\Admin\AppData\Local\Temp\~sfx001B218F6C\Wnz-Hack.exe
      "C:\Users\Admin\AppData\Local\Temp\~sfx001B218F6C\Wnz-Hack.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4228

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\~sfx001B218F6C\Wnz-Hack.exe
          Filesize

          32KB

          MD5

          8af5382979e468093cb0f271cb0a89cf

          SHA1

          a302ab4cca01c25ee26dfe56d2620fcd54fd2298

          SHA256

          405b8898881f0d7364b467a61ef1d9380b7b89e9eb8d8c42dc53682d4ba775cd

          SHA512

          914001b40bc85966f7dc8c606fbbcfbd21dbf67a18df2de97a97f5df24e162a92b23d2242cf101a56b747920c15d9649cd6652a2b0ef72bd17952153718fe5d8

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\~sfx001B218F6C\Wnz-Hack.exe
          Filesize

          32KB

          MD5

          8af5382979e468093cb0f271cb0a89cf

          SHA1

          a302ab4cca01c25ee26dfe56d2620fcd54fd2298

          SHA256

          405b8898881f0d7364b467a61ef1d9380b7b89e9eb8d8c42dc53682d4ba775cd

          SHA512

          914001b40bc85966f7dc8c606fbbcfbd21dbf67a18df2de97a97f5df24e162a92b23d2242cf101a56b747920c15d9649cd6652a2b0ef72bd17952153718fe5d8

          Download Submit

        • memory/4228-137-0x0000000000400000-0x000000000040ED06-memory.dmp

          Filesize

          59KB

          Download

        • memory/4228-138-0x0000000000400000-0x000000000040ED06-memory.dmp

          Filesize

          59KB

          Download