Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
23/03/2023, 10:20
General
-
Target
3c090759adcc30a43713288c1402aed192de0fca5e81ba0eaa9761f4650b3a53.exe
-
Size
2.9MB
-
MD5
4f46caafce5f453d08314cb0b9b49cad
-
SHA1
d54c6277d7357e083123800406af2f076259ba2e
-
SHA256
3c090759adcc30a43713288c1402aed192de0fca5e81ba0eaa9761f4650b3a53
-
SHA512
d6477486ce04ce2fea697a087998acfa1fd673db9f6c0449bccdd426575bcb423698a633af8d58413041f576792e4a18a0ae39ccd195025b5c70b135277fc1c8
-
SSDEEP
49152:8LA5zfFMoFJ1M7HbLqRQ6QOjMVb37zGheWRn/Xj+xNtKx1dACrVzLlPa0m7olOI4:8LAhFnUHvqzQOgVbLz0J/T+xNMxTJ1lg
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c090759adcc30a43713288c1402aed192de0fca5e81ba0eaa9761f4650b3a53.exe"C:\Users\Admin\AppData\Local\Temp\3c090759adcc30a43713288c1402aed192de0fca5e81ba0eaa9761f4650b3a53.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\OracleTemplates-type9.8.0.2\OracleTemplates-type9.8.0.2.exe"C:\ProgramData\OracleTemplates-type9.8.0.2\OracleTemplates-type9.8.0.2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
734.9MB
MD5fe736cbbed32e6ad6f9d5fad460d4778
SHA10e94366500eb4747e1f08e6e8ffa7f890e14e366
SHA256707b23cce08be4b30120d45e22e5b9e2582be6ce8e0cadd6eff2dabd58feeb07
SHA512a008cd02d0b3a99ed63ae6857c7d1530fd14c8424be29be40dad15727fa1edc5671f5b9de9328b85b8cde4685c29d63e46ea055219673a2ba0fa2f4eaf337e84
-
Filesize
734.9MB
MD5fe736cbbed32e6ad6f9d5fad460d4778
SHA10e94366500eb4747e1f08e6e8ffa7f890e14e366
SHA256707b23cce08be4b30120d45e22e5b9e2582be6ce8e0cadd6eff2dabd58feeb07
SHA512a008cd02d0b3a99ed63ae6857c7d1530fd14c8424be29be40dad15727fa1edc5671f5b9de9328b85b8cde4685c29d63e46ea055219673a2ba0fa2f4eaf337e84
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
8KB
-
Filesize
4.5MB
-
Filesize
8KB
-
Filesize
4.5MB
-
Filesize
8KB
-
Filesize
524KB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
524KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB