296b2e32375ff6a59eaa192e18a837fe5bbdeeb6222b45f144767f91e798b036

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2023 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sysclean.exe
Size

45KB
MD5

39314366abfd251a0cdc8a788405b274
SHA1

18c64bbdacebe03c95a7795dd6a826d106d9dd53
SHA256

296b2e32375ff6a59eaa192e18a837fe5bbdeeb6222b45f144767f91e798b036
SHA512

c1af42ec5dc325852b819567fbb8d1e6b68e068a7bd58bc7e6807d0b938ac9ef789eba25dcb9ba5f8ef4b72a9135e704a9c01bf7b2fe32ad33e2961749a59781
SSDEEP

768:zpm7BcEKNvBcvL6VeRNL1a6ZO4PTPz+o+CKr3zQ4NuVVWgP4+zLnbcuyD7U:zpfEKNCj6VoJl9Go5K7s4Nu31nouy8

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1408-132-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/1408-137-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	sysclean.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4948	PING.EXE
2248	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2676	1408	sysclean.exe	78
PID 1408 wrote to memory of 2676	1408	sysclean.exe	78
PID 2676 wrote to memory of 4948	2676	cmd.exe	81
PID 2676 wrote to memory of 4948	2676	cmd.exe	81
PID 2676 wrote to memory of 2248	2676	cmd.exe	82
PID 2676 wrote to memory of 2248	2676	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\sysclean.exe
"C:\Users\Admin\AppData\Local\Temp\sysclean.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EA36.tmp\EA37.tmp\EA38.bat C:\Users\Admin\AppData\Local\Temp\sysclean.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4948
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EA36.tmp\EA37.tmp\EA38.bat

Filesize
111B

MD5
1418f8f753a323f07977b778052bc9fe

SHA1
24831d8b35fb14062c9c0b83c1fa43b0b521242e

SHA256
f05edd34f5ff291ec9ecdbe6b650ac3c098b761bd179a6ec5e5760e30aea0ba2

SHA512
61d3cf280a3c9b2fcfb889640ba65e7526748e74b5eaa64ec9a3a74bad3874eb361ac8b6f962bfb30721d697b2e94831a544ea7095128b4a41c27cdde87838b2

Download Submit
memory/1408-132-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1408-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2248-136-0x0000000000000000-mapping.dmp

Download
memory/2676-133-0x0000000000000000-mapping.dmp

Download
memory/4948-135-0x0000000000000000-mapping.dmp

Download