Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
10-01-2023 01:43
General
-
Target
506af351a6161f5c18fc7dbd67174ca317641d17.exe
-
Size
117KB
-
MD5
2c9169600974ec7c6b6a6bd38bccda1a
-
SHA1
506af351a6161f5c18fc7dbd67174ca317641d17
-
SHA256
4d5d4495e3f5787646b35e6e2e4ba1f6b1962b19a516c24191776ff6201b419d
-
SHA512
e94d66945fe56d86e90c3f587468240143912b835382f35cfd246ffcaa4d79174e8d24fecf51be7e2edd2283206a581a26a70663e12dcd59e2f0626f2ce6d7a4
-
SSDEEP
3072:m8iL6pVpwLDi9k9ZW9nkv8dudL9Fvjsp3XzbNBZ:HiLQDwLDOnkcudZxsFdz
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks for any installed AV software in registry 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\506af351a6161f5c18fc7dbd67174ca317641d17.exe"C:\Users\Admin\AppData\Local\Temp\506af351a6161f5c18fc7dbd67174ca317641d17.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
8KB
-
Filesize
272KB
-
Filesize
68KB
-
Filesize
8KB