Resubmissions
22/03/2023, 12:07
230322-pafjmagf74 722/03/2023, 12:05
230322-n9pe5sgf67 722/03/2023, 10:15
230322-maftaagc26 7Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
22/03/2023, 10:15
General
-
Target
7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe
-
Size
7.8MB
-
MD5
89f7111c4e38e1b15d34cd9c294e410f
-
SHA1
af2afcafd84f6f6fae558975a8b9a86eb8736bce
-
SHA256
7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006
-
SHA512
2285893d4a5f3e020d77c68b86a10cf071b63a3bda826290613939285f045f403e545b8c026d254095e40d3cfe0acaf1c98d84d4817b1fb8b1b4f7ad41fee367
-
SSDEEP
98304:7Tk8J2RM4/x0lBKz3DM2k0JNl/6hLIhlPcArUNpHHKtXfvZv2LMnL5wGwCtT/PCB:U8GM493FZ+LGrUy0IL/B
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe"C:\Users\Admin\AppData\Local\Temp\7a9b9d247b96c611ffa61b99a7e5bf71a80c6891e99c3a9e8b4c87216e4c4006.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\regid.1991-06.com.microsoftOracle-tupe9.3.4.5\regid.1991-06.com.microsoftOracle-tupe9.3.4.5.exe"C:\ProgramData\regid.1991-06.com.microsoftOracle-tupe9.3.4.5\regid.1991-06.com.microsoftOracle-tupe9.3.4.5.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
832.9MB
MD5f352980816e8d1f2377299652317533a
SHA180c101ad7d3277eae74947077823011f9208600c
SHA256ab76d191e59fe4853655f951a8f99ed8bec7162c7f3e798cf53a1cf1e3c30c57
SHA51239ad8917676bf7c3f2e5e09220798c978f97942b00ac4f54204a686026d491b8cd849ee321ea6c55e29486f96f15e3f1a1373e5535530053e0ce5dc237c63be4
-
Filesize
832.9MB
MD5f352980816e8d1f2377299652317533a
SHA180c101ad7d3277eae74947077823011f9208600c
SHA256ab76d191e59fe4853655f951a8f99ed8bec7162c7f3e798cf53a1cf1e3c30c57
SHA51239ad8917676bf7c3f2e5e09220798c978f97942b00ac4f54204a686026d491b8cd849ee321ea6c55e29486f96f15e3f1a1373e5535530053e0ce5dc237c63be4
-
Filesize
10.5MB
-
Filesize
10.5MB
-
Filesize
10.5MB
-
Filesize
10.5MB
-
Filesize
10.5MB
-
Filesize
10.5MB
-
Filesize
10.5MB
-
Filesize
10.5MB
-
Filesize
10.5MB