Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
06/03/2023, 02:54
General
-
Target
0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05.exe
-
Size
171KB
-
MD5
0d1a5afe8ff4299a6e4e5c9eaca3a8d0
-
SHA1
4c9cb8cedfc423ce7ed544a0214373411d543757
-
SHA256
0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05
-
SHA512
f790c01978caef194eb40d0fdc419ec8f8c7ae3c508c7ee1461f86a66be42def0f610a7a21f4b1b17e37dd790e645605f1a41b6bd8b0f042fa1b9a761a000356
-
SSDEEP
3072:Bswv8vAW/6zD2EoCKGDYftbs4OTLGvc822:B7k/6Fs1buKv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05.exe"C:\Users\Admin\AppData\Local\Temp\0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05.exe"1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05" /tr "C:\Users\Admin\AppData\Roaming\0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05.exe"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05.exeC:\Users\Admin\AppData\Roaming\0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05.exeC:\Users\Admin\AppData\Roaming\0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05.exeC:\Users\Admin\AppData\Roaming\0aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5764d77a1fe83fb63d329d05881b91079
SHA11c56e9039ffba5c2975afffb6d13295e8819839d
SHA256fefe4090fc5e9f2f10f7abc5e23cfe9f26d8c69a27f48e7c4ff5017eac66a9bb
SHA512702621e4baa23cc209f87d54ead3f767b8ef4d8c3745e070fe356d72fde2dd1de520d703f6d029e074ea53751bd347a496a5a5580f691514a1c11e0c71d723c8
-
Filesize
171KB
MD50d1a5afe8ff4299a6e4e5c9eaca3a8d0
SHA14c9cb8cedfc423ce7ed544a0214373411d543757
SHA2560aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05
SHA512f790c01978caef194eb40d0fdc419ec8f8c7ae3c508c7ee1461f86a66be42def0f610a7a21f4b1b17e37dd790e645605f1a41b6bd8b0f042fa1b9a761a000356
-
Filesize
171KB
MD50d1a5afe8ff4299a6e4e5c9eaca3a8d0
SHA14c9cb8cedfc423ce7ed544a0214373411d543757
SHA2560aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05
SHA512f790c01978caef194eb40d0fdc419ec8f8c7ae3c508c7ee1461f86a66be42def0f610a7a21f4b1b17e37dd790e645605f1a41b6bd8b0f042fa1b9a761a000356
-
Filesize
171KB
MD50d1a5afe8ff4299a6e4e5c9eaca3a8d0
SHA14c9cb8cedfc423ce7ed544a0214373411d543757
SHA2560aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05
SHA512f790c01978caef194eb40d0fdc419ec8f8c7ae3c508c7ee1461f86a66be42def0f610a7a21f4b1b17e37dd790e645605f1a41b6bd8b0f042fa1b9a761a000356
-
Filesize
171KB
MD50d1a5afe8ff4299a6e4e5c9eaca3a8d0
SHA14c9cb8cedfc423ce7ed544a0214373411d543757
SHA2560aaa331ee252f7fe6824fd7ec5de659bffc2b1447a026012371ff8f6f0b71e05
SHA512f790c01978caef194eb40d0fdc419ec8f8c7ae3c508c7ee1461f86a66be42def0f610a7a21f4b1b17e37dd790e645605f1a41b6bd8b0f042fa1b9a761a000356
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
200KB
-
Filesize
64KB