7c99bc3785e597fbccc65e7b9d534faa3744314750863c0f43b5e56a85eda72b

Analysis

max time kernel
143s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2023, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c99bc3785e597fbccc65e7b9d534faa3744314750863c0f43b5e56a85eda72b.exe
Size

3.6MB
MD5

ab290b8009edf9795c4f5b35170c7618
SHA1

256da3535e340a39d4134c8ec4508f33e0d1c9bc
SHA256

7c99bc3785e597fbccc65e7b9d534faa3744314750863c0f43b5e56a85eda72b
SHA512

0602f8ec33b234cd12d29d76a695f48defaba19538dbc15a217991c76fadb4981984e95e5f429fc2084ac8d180204b2dccb3fc588274cb6af8458378947fb900
SSDEEP

98304:9mND8Is8fvm5J4HTSiRd6uxcl9k3dutXJVuRY8J57URb+w:920YeA+46uGlW3wAiKw

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	7c99bc3785e597fbccc65e7b9d534faa3744314750863c0f43b5e56a85eda72b.exe

Executes dropped EXE 1 IoCs

pid	Process
3312	irsetup.exe

Loads dropped DLL 1 IoCs

pid	Process
3312	irsetup.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023151-139.dat	upx
behavioral2/files/0x0008000000023151-143.dat	upx
behavioral2/files/0x0008000000023151-144.dat	upx
behavioral2/memory/3312-147-0x0000000000400000-0x00000000007CA000-memory.dmp	upx
behavioral2/memory/3312-160-0x0000000000400000-0x00000000007CA000-memory.dmp	upx
behavioral2/memory/3312-165-0x0000000000400000-0x00000000007CA000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3312	irsetup.exe
3312	irsetup.exe
3312	irsetup.exe
3312	irsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 3312	2612	7c99bc3785e597fbccc65e7b9d534faa3744314750863c0f43b5e56a85eda72b.exe	86
PID 2612 wrote to memory of 3312	2612	7c99bc3785e597fbccc65e7b9d534faa3744314750863c0f43b5e56a85eda72b.exe	86
PID 2612 wrote to memory of 3312	2612	7c99bc3785e597fbccc65e7b9d534faa3744314750863c0f43b5e56a85eda72b.exe	86

C:\Users\Admin\AppData\Local\Temp\7c99bc3785e597fbccc65e7b9d534faa3744314750863c0f43b5e56a85eda72b.exe
"C:\Users\Admin\AppData\Local\Temp\7c99bc3785e597fbccc65e7b9d534faa3744314750863c0f43b5e56a85eda72b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1738602 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\7c99bc3785e597fbccc65e7b9d534faa3744314750863c0f43b5e56a85eda72b.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1675742406-747946869-1029867430-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
05c57b8a06794280093bf8775e21ee3f

SHA1
44cd64a19da5a8bab5056da0d2fcdd7289f79568

SHA256
56831986bd33b7ffc2e6830873e207f37ed798ba80b5b9624cfcfde11c80fb80

SHA512
66b2eb147014248b600194e1d93745825332ac8a4bb885eb1804a75862984bc7cdf8fea095803429a300797367efc014d711ecaffb8ba460c71fc37dee5b8b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
05c57b8a06794280093bf8775e21ee3f

SHA1
44cd64a19da5a8bab5056da0d2fcdd7289f79568

SHA256
56831986bd33b7ffc2e6830873e207f37ed798ba80b5b9624cfcfde11c80fb80

SHA512
66b2eb147014248b600194e1d93745825332ac8a4bb885eb1804a75862984bc7cdf8fea095803429a300797367efc014d711ecaffb8ba460c71fc37dee5b8b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
05c57b8a06794280093bf8775e21ee3f

SHA1
44cd64a19da5a8bab5056da0d2fcdd7289f79568

SHA256
56831986bd33b7ffc2e6830873e207f37ed798ba80b5b9624cfcfde11c80fb80

SHA512
66b2eb147014248b600194e1d93745825332ac8a4bb885eb1804a75862984bc7cdf8fea095803429a300797367efc014d711ecaffb8ba460c71fc37dee5b8b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
318KB

MD5
4bcce2f6581bb46564155f3576028987

SHA1
5d24976dfc30d5fe09c7de1a4617cea3543296d4

SHA256
94deef0a6a60213b3020334aede2eb5c7aa39286833a6699f8fd439c7cce63cf

SHA512
a66f61a8a45c3086f48333891fb3f91535b1361c1c0dd196c91b56c89abdcbbc1d515d2c38e09a023a3845a93ac199871a2ef2fc4b5b72d96a529cbfd58bb76d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
318KB

MD5
4bcce2f6581bb46564155f3576028987

SHA1
5d24976dfc30d5fe09c7de1a4617cea3543296d4

SHA256
94deef0a6a60213b3020334aede2eb5c7aa39286833a6699f8fd439c7cce63cf

SHA512
a66f61a8a45c3086f48333891fb3f91535b1361c1c0dd196c91b56c89abdcbbc1d515d2c38e09a023a3845a93ac199871a2ef2fc4b5b72d96a529cbfd58bb76d

Download Submit
memory/3312-147-0x0000000000400000-0x00000000007CA000-memory.dmp

Filesize
3.8MB

Download
memory/3312-160-0x0000000000400000-0x00000000007CA000-memory.dmp

Filesize
3.8MB

Download
memory/3312-165-0x0000000000400000-0x00000000007CA000-memory.dmp

Filesize
3.8MB

Download