Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
05/12/2022, 09:06
General
-
Target
adfac3fa868ffce00ac8dd42c4d12421d485e62bd0b84483e2fed1cd70efc2bb.exe
-
Size
175KB
-
MD5
1d7343629779fc2996a0f325cddd26de
-
SHA1
20ddcc193c7b13322c3cf9ff298d128e556315ab
-
SHA256
adfac3fa868ffce00ac8dd42c4d12421d485e62bd0b84483e2fed1cd70efc2bb
-
SHA512
a3591ed28120db00e6732e2fd9a5675619ce08ccb58ea1379fc9ac5730cb2b1a2323a11f99ef796dda707f90002bcec0e36f9403c393d1df0b0a49e6c0ce248e
-
SSDEEP
3072:ZHQMls87bHbflGtlhw9jdx6eV5p+JyLhFCUP9uVxihTk:ZdF7bHbdGtlOjCq5ptQxia
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\adfac3fa868ffce00ac8dd42c4d12421d485e62bd0b84483e2fed1cd70efc2bb.exe"C:\Users\Admin\AppData\Local\Temp\adfac3fa868ffce00ac8dd42c4d12421d485e62bd0b84483e2fed1cd70efc2bb.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" firewall set allowedprogram program = "C:\Windows\bcastdvr\explorer.exe" name = "Explorer" mode = ENABLE scope = ALL profile = ALL2⤵
- Modifies Windows Firewall
-
-
C:\Windows\bcastdvr\explorer.exe"C:\Windows\bcastdvr\explorer.exe" C:\noexistfile.txt2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD51d7343629779fc2996a0f325cddd26de
SHA120ddcc193c7b13322c3cf9ff298d128e556315ab
SHA256adfac3fa868ffce00ac8dd42c4d12421d485e62bd0b84483e2fed1cd70efc2bb
SHA512a3591ed28120db00e6732e2fd9a5675619ce08ccb58ea1379fc9ac5730cb2b1a2323a11f99ef796dda707f90002bcec0e36f9403c393d1df0b0a49e6c0ce248e
-
Filesize
175KB
MD51d7343629779fc2996a0f325cddd26de
SHA120ddcc193c7b13322c3cf9ff298d128e556315ab
SHA256adfac3fa868ffce00ac8dd42c4d12421d485e62bd0b84483e2fed1cd70efc2bb
SHA512a3591ed28120db00e6732e2fd9a5675619ce08ccb58ea1379fc9ac5730cb2b1a2323a11f99ef796dda707f90002bcec0e36f9403c393d1df0b0a49e6c0ce248e
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB