Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
08-02-2023 03:01
General
-
Target
ultdata-android.exe
-
Size
2.1MB
-
MD5
fdb3d5a897b8f1d0330b1486cf14a7a0
-
SHA1
4e513d885a325ec098bf24c6c8cb840f5c2e0fe7
-
SHA256
9177f4ea7d98bf6d047fe3a871fa7ce78432bb8644aa7b0d4f94c08313e27956
-
SHA512
3cc9cc1cf35c60a046a55614215b12fbb01ddf06fd50db7d39f683d166ac14901b9fc33536e6a6a72db5b5e314dacf35a1b5389bdbf315b1c7b89b40dd7af07a
-
SSDEEP
49152:RBrmqX5EIZ1h+Fyamj4NIyH1HWS4cxX8Q/UEOZaAMnQ:RA+EG7tZDS408QMaAD
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 7 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ultdata-android.exe"C:\Users\Admin\AppData\Local\Temp\ultdata-android.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\androiddatarecovery_ts\androiddatarecovery_ts6.8.2.exe/VERYSILENT /SP- /NORESTART /DIR="C:\Program Files (x86)\Tenorshare\UltData - Android Data Recovery\" /LANG=en /LOG="C:\Users\Admin\AppData\Local\Temp\UltData - Android Data Recovery_Setup_20230208040311.log"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TJIGL.tmp\androiddatarecovery_ts6.8.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-TJIGL.tmp\androiddatarecovery_ts6.8.2.tmp" /SL5="$100156,161557776,575488,C:\Users\Admin\AppData\Local\Temp\androiddatarecovery_ts\androiddatarecovery_ts6.8.2.exe" /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files (x86)\Tenorshare\UltData - Android Data Recovery\" /LANG=en /LOG="C:\Users\Admin\AppData\Local\Temp\UltData - Android Data Recovery_Setup_20230208040311.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154.6MB
MD5c16b5acbc8392b8ddaa98772cd6b1c17
SHA167a30bdbde9b71176e4b359657a3dd09b13b55e8
SHA2563a3a2ab80d703935eb16010870060fb1996ac0c887a3ee05078340842d40fa7d
SHA512d9e9cfed4c9e44d0b18313765726cd25c0ee2200b3dbdcb3543efa16cfd20a3d4f361f98fb17a047e922c0b9a99b0dfe11a633afd359198416d30aa718a0e40a
-
Filesize
154.6MB
MD5c16b5acbc8392b8ddaa98772cd6b1c17
SHA167a30bdbde9b71176e4b359657a3dd09b13b55e8
SHA2563a3a2ab80d703935eb16010870060fb1996ac0c887a3ee05078340842d40fa7d
SHA512d9e9cfed4c9e44d0b18313765726cd25c0ee2200b3dbdcb3543efa16cfd20a3d4f361f98fb17a047e922c0b9a99b0dfe11a633afd359198416d30aa718a0e40a
-
Filesize
1.6MB
MD5ab7e4c420754e8d917c2e8b9ab6685f3
SHA1a74c0ad98840570250560e44e87dbd6542a2ffb1
SHA2565133d562ed85765b90c8d44b5c44f2d3d6097b589db152ef78f844095fcab083
SHA51245c9dd9327c5c24ca1757c17310636edc135b3cf24a4f4cb152d31f5a67dab284c4e45c1af9d36c0dd1c48fbafe58aba3f83f0ef2d5fca401e2f21382d369c3a
-
Filesize
1.6MB
MD5ab7e4c420754e8d917c2e8b9ab6685f3
SHA1a74c0ad98840570250560e44e87dbd6542a2ffb1
SHA2565133d562ed85765b90c8d44b5c44f2d3d6097b589db152ef78f844095fcab083
SHA51245c9dd9327c5c24ca1757c17310636edc135b3cf24a4f4cb152d31f5a67dab284c4e45c1af9d36c0dd1c48fbafe58aba3f83f0ef2d5fca401e2f21382d369c3a
-
Filesize
4.4MB
MD51385ffa0d9df77fa8761481c41d680ed
SHA1e201af1719985e560161c52fce1e4f7d8a930acb
SHA2560d10cf3112d6f59cf9c131c4726fb674800c2500105f7a9e8a0955ae8de735a6
SHA5128c7db339bea3a758ea0608a75069d501f145da489966f920b5ecd93d82216a3e777e5d936930923993b5bfa018eec87041b2ee3dcea776c21f73622aed6bc4bb
-
Filesize
4.4MB
MD51385ffa0d9df77fa8761481c41d680ed
SHA1e201af1719985e560161c52fce1e4f7d8a930acb
SHA2560d10cf3112d6f59cf9c131c4726fb674800c2500105f7a9e8a0955ae8de735a6
SHA5128c7db339bea3a758ea0608a75069d501f145da489966f920b5ecd93d82216a3e777e5d936930923993b5bfa018eec87041b2ee3dcea776c21f73622aed6bc4bb
-
Filesize
1.6MB
MD5ab7e4c420754e8d917c2e8b9ab6685f3
SHA1a74c0ad98840570250560e44e87dbd6542a2ffb1
SHA2565133d562ed85765b90c8d44b5c44f2d3d6097b589db152ef78f844095fcab083
SHA51245c9dd9327c5c24ca1757c17310636edc135b3cf24a4f4cb152d31f5a67dab284c4e45c1af9d36c0dd1c48fbafe58aba3f83f0ef2d5fca401e2f21382d369c3a
-
Filesize
154.6MB
MD5c16b5acbc8392b8ddaa98772cd6b1c17
SHA167a30bdbde9b71176e4b359657a3dd09b13b55e8
SHA2563a3a2ab80d703935eb16010870060fb1996ac0c887a3ee05078340842d40fa7d
SHA512d9e9cfed4c9e44d0b18313765726cd25c0ee2200b3dbdcb3543efa16cfd20a3d4f361f98fb17a047e922c0b9a99b0dfe11a633afd359198416d30aa718a0e40a
-
Filesize
154.6MB
MD5c16b5acbc8392b8ddaa98772cd6b1c17
SHA167a30bdbde9b71176e4b359657a3dd09b13b55e8
SHA2563a3a2ab80d703935eb16010870060fb1996ac0c887a3ee05078340842d40fa7d
SHA512d9e9cfed4c9e44d0b18313765726cd25c0ee2200b3dbdcb3543efa16cfd20a3d4f361f98fb17a047e922c0b9a99b0dfe11a633afd359198416d30aa718a0e40a
-
Filesize
154.6MB
MD5c16b5acbc8392b8ddaa98772cd6b1c17
SHA167a30bdbde9b71176e4b359657a3dd09b13b55e8
SHA2563a3a2ab80d703935eb16010870060fb1996ac0c887a3ee05078340842d40fa7d
SHA512d9e9cfed4c9e44d0b18313765726cd25c0ee2200b3dbdcb3543efa16cfd20a3d4f361f98fb17a047e922c0b9a99b0dfe11a633afd359198416d30aa718a0e40a
-
Filesize
1.6MB
MD5ab7e4c420754e8d917c2e8b9ab6685f3
SHA1a74c0ad98840570250560e44e87dbd6542a2ffb1
SHA2565133d562ed85765b90c8d44b5c44f2d3d6097b589db152ef78f844095fcab083
SHA51245c9dd9327c5c24ca1757c17310636edc135b3cf24a4f4cb152d31f5a67dab284c4e45c1af9d36c0dd1c48fbafe58aba3f83f0ef2d5fca401e2f21382d369c3a
-
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
600KB
-
-
Filesize
600KB