Analysis

  • max time kernel
    108s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2023, 19:15

General

  • Target

    7c1f92a9a266203692ca499bfbb474346e234f6395bb73723e59381a102f9ed4.exe

  • Size

    10.9MB

  • MD5

    45cf5dc45f41d2359fe12cb70be00e29

  • SHA1

    ec48ed2e3c2df019b71251220108c06862c2617a

  • SHA256

    7c1f92a9a266203692ca499bfbb474346e234f6395bb73723e59381a102f9ed4

  • SHA512

    ab55dc78ab7e73550982cda4f57f9e3df59377be98e4fef0552cf1c4642912a90a24c216075e8b90c06981451b8968fc968957542acc7e8cc0003d26db41c7fa

  • SSDEEP

    196608:oStdgnrUUm+7UiFG8xHeKvpIMP91SK085Psfi20i7APviOpiYkGO8z0H:oGSgUmHiFG8x+kCMeA5O2XPpiYkr8

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c1f92a9a266203692ca499bfbb474346e234f6395bb73723e59381a102f9ed4.exe
    "C:\Users\Admin\AppData\Local\Temp\7c1f92a9a266203692ca499bfbb474346e234f6395bb73723e59381a102f9ed4.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\ProgramData\TemplatesOracle-type5.5.0.0\TemplatesOracle-type5.5.0.0.exe
      "C:\ProgramData\TemplatesOracle-type5.5.0.0\TemplatesOracle-type5.5.0.0.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4824

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\TemplatesOracle-type5.5.0.0\TemplatesOracle-type5.5.0.0.exe

    Filesize

    587.7MB

    MD5

    befb02a953635ce01dabc7de0cf30d98

    SHA1

    d78fc786ae1592aa24b31633b5c145e239e29992

    SHA256

    6b53584aa93c9a524378903cdeb5bf39c33123e85c9566edc9366bb15971648d

    SHA512

    447e8c89c359e2468acba237e75e87ce92c6832cfdbf03185ea34cdf184c38e197037a79b3c513f9a8d7ef9bc4c743223fa4e00cf5350618553ad5162e51c6f7

  • C:\ProgramData\TemplatesOracle-type5.5.0.0\TemplatesOracle-type5.5.0.0.exe

    Filesize

    587.7MB

    MD5

    befb02a953635ce01dabc7de0cf30d98

    SHA1

    d78fc786ae1592aa24b31633b5c145e239e29992

    SHA256

    6b53584aa93c9a524378903cdeb5bf39c33123e85c9566edc9366bb15971648d

    SHA512

    447e8c89c359e2468acba237e75e87ce92c6832cfdbf03185ea34cdf184c38e197037a79b3c513f9a8d7ef9bc4c743223fa4e00cf5350618553ad5162e51c6f7

  • memory/3348-137-0x0000000000400000-0x00000000014F1000-memory.dmp

    Filesize

    16.9MB

  • memory/3348-132-0x0000000000400000-0x00000000014F1000-memory.dmp

    Filesize

    16.9MB

  • memory/3348-138-0x0000000000400000-0x00000000014F1000-memory.dmp

    Filesize

    16.9MB

  • memory/3348-134-0x0000000000400000-0x00000000014F1000-memory.dmp

    Filesize

    16.9MB

  • memory/3348-133-0x0000000000400000-0x00000000014F1000-memory.dmp

    Filesize

    16.9MB

  • memory/3348-143-0x0000000000400000-0x00000000014F1000-memory.dmp

    Filesize

    16.9MB

  • memory/4824-144-0x0000000000400000-0x00000000014F1000-memory.dmp

    Filesize

    16.9MB

  • memory/4824-145-0x0000000000400000-0x00000000014F1000-memory.dmp

    Filesize

    16.9MB

  • memory/4824-148-0x0000000000400000-0x00000000014F1000-memory.dmp

    Filesize

    16.9MB

  • memory/4824-149-0x0000000000400000-0x00000000014F1000-memory.dmp

    Filesize

    16.9MB