Overview

overview

8

Static

static

43cea08f82...58.exe

windows7-x64

8

43cea08f82...58.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    86s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2023, 00:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    43cea08f82b0748529a9776b9d2835e8a0f064c9ed81cb8091223bc644889c58.exe
  • Size 168KB
  • Sample230202-alts3adf57
  • SHA256 43cea08f82b0748529a9776b9d2835e8a0f064c9ed81cb8091223bc644889c58
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43cea08f82b0748529a9776b9d2835e8a0f064c9ed81cb8091223bc644889c58.exe
    "C:\Users\Admin\AppData\Local\Temp\43cea08f82b0748529a9776b9d2835e8a0f064c9ed81cb8091223bc644889c58.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\iPaste\iPaste.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\iPaste\iPaste.exe" /iPaste.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4056

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        iHook.dll
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\iPaste\iHook.dll
        • Size 16KB
        • SHA256 7fbb4a38673812934850ab5dccbd25d2edafb3126a61aa84448832100e6de67a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        iPaste.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\iPaste\iPaste.exe
        • Size 71KB
        • SHA256 3f55f307622c1b13d7ecb640d735a626148f6aea44be4d29f866a67cadee75cc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        iPaste.exe
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\iPaste\iPaste.exe
        • Size 71KB
        • SHA256 3f55f307622c1b13d7ecb640d735a626148f6aea44be4d29f866a67cadee75cc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        paste.ini
        • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\iPaste\paste.ini
        • Size 29KB
        • SHA256 1fac3f88e2ec6ed4a9db7c3f317154303f023960006ecc4e260040d05761ab83
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/4056-135-0x00007FF80DE50000-0x00007FF80E886000-memory.dmp
        Download