Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
03-02-2023 19:33
General
-
Target
decrypted_2.exe
-
Size
479KB
-
MD5
73d9cfaa50432fbb0133e3abfce5f40c
-
SHA1
6ff96f23aef03fbf7efdee970304005cfae8f088
-
SHA256
d73e9d1fc1c5eca7d3e3c236833f6f98ec189d57aadd08bee5806170cdab6c1a
-
SHA512
46d8901bcd853cbff340cd85a0bc980e782a174aa4c8204f7cd7a577c080442e78fb89ed49837cf7a7574ef85e31c70b4baeab292281ed3fe8e19671344eeb2a
-
SSDEEP
6144:UTouKrWBEu3/Z2lpGDHU3ykJmnRT/EXsbIh/JW6skkf28J:UToPWBv/cpGrU3y/nNesbIZJW6nSfJ
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\decrypted_2.exe"C:\Users\Admin\AppData\Local\Temp\decrypted_2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wlninit.exe"C:\Users\Admin\AppData\Roaming\wlninit.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\wlninit.exe" "wlninit.exe" ENABLE4⤵
- Modifies Windows Firewall
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5f3867179dffab4476e51f1ea3e0e730b
SHA1b4207587e8417a93dbfe5be3a9d885df6f7fcc74
SHA2561be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2
SHA512553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a
-
Filesize
52KB
MD5f3867179dffab4476e51f1ea3e0e730b
SHA1b4207587e8417a93dbfe5be3a9d885df6f7fcc74
SHA2561be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2
SHA512553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a
-
Filesize
13KB
MD5e7304abaea601b10c1fd25f73643b8b2
SHA1d6310b99c1f7819071f1a6e24e06c3178ebc3f0b
SHA25620b002b1f913fa83a2c05a63881936e839195e9196f15fc92f9b66604fc6fd6c
SHA512969d59a4533bcd25b440529d92be206700b6e4e6f07f9b283bf1d1ae2961543261dbe49d9649d79568e54d149cc4b41fef26e364929893fae8f53c3ed907ac2c
-
Filesize
13KB
MD5e7304abaea601b10c1fd25f73643b8b2
SHA1d6310b99c1f7819071f1a6e24e06c3178ebc3f0b
SHA25620b002b1f913fa83a2c05a63881936e839195e9196f15fc92f9b66604fc6fd6c
SHA512969d59a4533bcd25b440529d92be206700b6e4e6f07f9b283bf1d1ae2961543261dbe49d9649d79568e54d149cc4b41fef26e364929893fae8f53c3ed907ac2c
-
Filesize
52KB
MD5f3867179dffab4476e51f1ea3e0e730b
SHA1b4207587e8417a93dbfe5be3a9d885df6f7fcc74
SHA2561be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2
SHA512553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a
-
Filesize
52KB
MD5f3867179dffab4476e51f1ea3e0e730b
SHA1b4207587e8417a93dbfe5be3a9d885df6f7fcc74
SHA2561be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2
SHA512553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB