Analysis
-
max time kernel
149s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
04/02/2023, 21:09 UTC
General
-
Target
Setup/Locales/es-419.pak
-
Size
317KB
-
MD5
32b26b9afb8dd050c0dabf5fa3c5f787
-
SHA1
11d0336356a1469727642db8a78d793f7cbf886d
-
SHA256
5e3439226db55927497df667b37a37b7c7307db4973ee46d9415c1e337ed4820
-
SHA512
f4ead39651e34da95181cfe448dffee8e46f8deaa6b47926b986201ec089d6af9320477311dc1824f1e535f75813cc09194bfbf77cefe573fe5e08f46b88c0d7
-
SSDEEP
3072:y1I8rQvEO/A+HVavjTxjze0nL13q+YHWyr8dN5TlQ+sQRBzgm9M:y1ZRO/7HVAmEggdN5KQRBzgm9M
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Setup\Locales\es-419.pak1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS176.122.125.40.in-addr.arpaRemote address:8.8.8.8:53Request176.122.125.40.in-addr.arpaIN PTRResponse -
DNSa.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpaRemote address:8.8.8.8:53Requesta.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpaIN PTRResponse
-
93.184.220.29:80
-
93.184.220.29:80
-
209.197.3.8:80
-
51.116.253.168:443 -
104.80.225.205:443 -
209.197.3.8:80
-
93.184.220.29:80
-
8.8.8.8:53176.122.125.40.in-addr.arpadns
DNS Request
176.122.125.40.in-addr.arpa
-
8.8.8.8:53a.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpadns
DNS Request
a.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa