Analysis
-
max time kernel
72s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
22/12/2022, 15:36
General
-
Target
tmp.exe
-
Size
18.7MB
-
MD5
e9ac98d12f10bb73d8d60defc7ba288d
-
SHA1
eac7dea8cebd84e4dfaf4f03be7817e19152a553
-
SHA256
3832b8802c39f80623740e3cc578fa2374b16ad4b56f42740394e9f5d61fad38
-
SHA512
015f4217fdf079c9fc76db85deab2d38178bc8d28fa75d2225082ea0625462d75c8b28b423a4f41d85c3e586dd5157af9381b2b301688ecd6a8c73447f62e3bb
-
SSDEEP
393216:zeRzdW+FYZ4lDx1iR93yVhIZgze2pgZaqWW3JY6o+GG2a+8MxZ2RX:zeRzdWYjlFu3yVhIke2KsqWW5Y6jM80c
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1758466 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\tmp.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2386679933-1492765628-3466841596-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD512b3b10657891cfa2bc0bed894750024
SHA11f9a378538a7236021ac91d02990eed04011ec77
SHA256248e769a67f8e82a2f8af1c809f732d0baa5b0023d8b3e204f4c9ede979aec85
SHA5121f0991b8e5788797c9b57d05077986a22abdb49c8eddca6f1ea379c9cd7a6ac045cb172a9152ce756509d09bfbe633df5ce11f60bf42d27bcda9be9674b3a242
-
Filesize
1.3MB
MD512b3b10657891cfa2bc0bed894750024
SHA11f9a378538a7236021ac91d02990eed04011ec77
SHA256248e769a67f8e82a2f8af1c809f732d0baa5b0023d8b3e204f4c9ede979aec85
SHA5121f0991b8e5788797c9b57d05077986a22abdb49c8eddca6f1ea379c9cd7a6ac045cb172a9152ce756509d09bfbe633df5ce11f60bf42d27bcda9be9674b3a242
-
Filesize
320KB
MD548e1d57965a584425a9aba84b668e416
SHA14d8e9f0f0b1848b37e7acd21ce126e2b572cccef
SHA256200fc76009fcad1e7651094dd1b3b4d31a01659972736d5658a5f9b10884b577
SHA512397afbcbaf8143c9a7f0cff434c1da33659ec7993f57b55cdd7d98f82a038851c4c103a2d6ad611c9989903cbb7e1666c1f35e4bd5c4b0cf59fd20fdbba069bf
-
Filesize
320KB
MD548e1d57965a584425a9aba84b668e416
SHA14d8e9f0f0b1848b37e7acd21ce126e2b572cccef
SHA256200fc76009fcad1e7651094dd1b3b4d31a01659972736d5658a5f9b10884b577
SHA512397afbcbaf8143c9a7f0cff434c1da33659ec7993f57b55cdd7d98f82a038851c4c103a2d6ad611c9989903cbb7e1666c1f35e4bd5c4b0cf59fd20fdbba069bf
-
Filesize
3.8MB