Analysis
-
max time kernel
91s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
06/12/2022, 18:29
General
-
Target
956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe
-
Size
123KB
-
MD5
4cea91ed1eb846b18aa88c3579c11340
-
SHA1
314d845a38f106fc3fbc08c5c0738f3442796de4
-
SHA256
956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606
-
SHA512
54605bf5c02879fe5a10970c1d05a56e92b291efcba64adaa1bd57d2643b27f5d08b5d8320cedcd40e122bc41f6514505cfcaa0502e385c57c52ee971d1089ee
-
SSDEEP
3072:0NO2i7982jeR8ex85R16DyHwwlOKSsu2ijub/vgX:pB82E8F6DPsOKSl2ijAgX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Drops file in Program Files directory 13 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe"C:\Users\Admin\AppData\Local\Temp\956ad260704ccd02abcaa99473ed6f288202afbd044216c9aad6323f235b9606.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\jafar\4u.scr"C:\Program Files (x86)\jafar\4u.scr" /S2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5f70d5908eed26d11709cee0ac0de636f
SHA1db7f684ce3b4e0c4090a1e1f04145206eed11cab
SHA256300291c4ac26ce1eebe549123a965326763a0d98d4fef08e3f5fb0ba11459b40
SHA512b2584c6ad760db5f539da0f74d0bfb2708a6785ae559c7ee8d9277d293826ab9d7adc5f7a49e10c9a0b42ae580b51b0992a6470326e09df057e0108a81b2dee9
-
Filesize
136KB
MD5f70d5908eed26d11709cee0ac0de636f
SHA1db7f684ce3b4e0c4090a1e1f04145206eed11cab
SHA256300291c4ac26ce1eebe549123a965326763a0d98d4fef08e3f5fb0ba11459b40
SHA512b2584c6ad760db5f539da0f74d0bfb2708a6785ae559c7ee8d9277d293826ab9d7adc5f7a49e10c9a0b42ae580b51b0992a6470326e09df057e0108a81b2dee9
-
Filesize
144KB
-
Filesize
144KB