10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078

General

Target
10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe
Size 1.2MB
Sample230131-hpszyafa66
SHA256 10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078
MD5 f191ef0d5a68a00dc5f4b7c5831639ad
SHA1 950d87ac468d10dee95605686479a4a4fa62500c
SHA512 7d19dc8e16b0d341741c4677141e0a598c97a61ca89d7df8c860815582e2fe968b9a5740fb4268dc5616e5b2c0593818b2aa39fa100fb95577d3b97c90d9fe82
SSDEEP 24576:c3qdBzNku+gM4ILHQ/Pq3TiZVVVtZUMWfoRcig68ymtkoK8iZn7E:PB9j5ILQu6VbUMWftiVX+kiWnI
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1240	CLaunch.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1688-132-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/3616-137-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/1688-141-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe

Loads dropped DLL 1 IoCs

pid	Process
1240	CLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	CLaunch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1240	CLaunch.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1240	CLaunch.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1240	CLaunch.exe
1240	CLaunch.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 3616	1688	10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe	82
PID 1688 wrote to memory of 3616	1688	10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe	82
PID 1688 wrote to memory of 3616	1688	10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe	82
PID 3616 wrote to memory of 1240	3616	10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe	83
PID 3616 wrote to memory of 1240	3616	10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe	83
PID 3616 wrote to memory of 1240	3616	10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe	83

C:\Users\Admin\AppData\Local\Temp\10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe
"C:\Users\Admin\AppData\Local\Temp\10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe
  "C:\Users\Admin\AppData\Local\Temp\10bcc2247e4bd3cd4536ec5a3c244bf3167a1a43cefb0ad925ac2ac184e15078.exe" -sfxwaitall:0 "CLaunch.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\CLaunch.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\CLaunch.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CLaunch.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\CLaunch.exe
Size 970KB
SHA256 1233508594ec70e604d6b5ed0a31dbc49021123b811ed1fd72d38934f61ce195
MD5 92642a29ac1e5344adba7f359f4b027f
SHA1 a8c6c68c231e202220fdb922f3bb87b787df6e1a
SHA512 9b2935e0a81b507dca7a91e02ef7e2dbd54c8075e90fcfb995b369afff27666b1146d9a385377c9707b712d369fcf20fe086a331286c2a65061bc0960d9f31ad
SSDEEP 24576:nCZzyKkBzN4/LIYv9eqMwJOyajbFDTmeOBzTDAouBNqHziaT+8ddU:CZzyZdN4/LIOeQDuPuziaT+1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CLaunch.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\CLaunch.exe
Size 970KB
SHA256 1233508594ec70e604d6b5ed0a31dbc49021123b811ed1fd72d38934f61ce195
MD5 92642a29ac1e5344adba7f359f4b027f
SHA1 a8c6c68c231e202220fdb922f3bb87b787df6e1a
SHA512 9b2935e0a81b507dca7a91e02ef7e2dbd54c8075e90fcfb995b369afff27666b1146d9a385377c9707b712d369fcf20fe086a331286c2a65061bc0960d9f31ad
SSDEEP 24576:nCZzyKkBzN4/LIYv9eqMwJOyajbFDTmeOBzTDAouBNqHziaT+8ddU:CZzyZdN4/LIOeQDuPuziaT+1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClHook.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ClHook.dll
Size 93KB
SHA256 0be6b179cbb452616ce3b828e8d207f6693b5763d93ca50194ec6d2744b057e6
MD5 e57badcdab32d4adf1d8d68cbc2acd06
SHA1 bae2ff80bf04331456e3904a784fe8029094c8d1
SHA512 a9c1e8bdd4bb6306fd5c7d494f274f09fe5797bc52c60e1288f7bb09b9f15690eef077f95b7a1a58cf16ab00c8096f2577a78475ce8525786ad4061206e76851
SSDEEP 1536:sjnmtOe/MY0Y+UwTuBJNxxzcAzMJcL+/DnZslsWMcdbCn9LJvVf:EnQOe/MTbYzxMJcL0KFbCn9LJvVf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClHook.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ClHook.dll
Size 93KB
SHA256 0be6b179cbb452616ce3b828e8d207f6693b5763d93ca50194ec6d2744b057e6
MD5 e57badcdab32d4adf1d8d68cbc2acd06
SHA1 bae2ff80bf04331456e3904a784fe8029094c8d1
SHA512 a9c1e8bdd4bb6306fd5c7d494f274f09fe5797bc52c60e1288f7bb09b9f15690eef077f95b7a1a58cf16ab00c8096f2577a78475ce8525786ad4061206e76851
SSDEEP 1536:sjnmtOe/MY0Y+UwTuBJNxxzcAzMJcL+/DnZslsWMcdbCn9LJvVf:EnQOe/MTbYzxMJcL0KFbCn9LJvVf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Language.ini

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Languages\Language.ini
Size 3KB
SHA256 46403b7b5e394569d5f4034fb4c7281eb6ee881e4d897c45dd447cb08d7ed240
MD5 06207469b4aaaa298793e796f615c696
SHA1 540452d3b383dcf4551178c32fbfcd3d445eec80
SHA512 52f812874d1fd0b344f794d4dfa531fb30bfa3e604d6d37fe49df953e2c14d3791f19345291c98a4574e8a2a2517d27dbc0ff3b4d3aa9974b6349fc7f06e23e6
MD5 SHA1 SHA512

Submit Download

memory/1688-132-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1688-141-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3616-137-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads