Analysis
-
max time kernel
15s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
26/03/2023, 22:31
General
-
Target
c9c3f781630b8f58c2cc2f100f91ead21dbbf0fd4f8afe223036b6f2b6f3ff25.exe
-
Size
48KB
-
MD5
17cb6d5155ae0733186556cc4f109446
-
SHA1
4e5978bc6e59986a22b74807c5e658b3b06f5ec7
-
SHA256
c9c3f781630b8f58c2cc2f100f91ead21dbbf0fd4f8afe223036b6f2b6f3ff25
-
SHA512
822d692886db2b963443d693ea80e0ff83c3c5b405ab5b58756a72a2f4c0c25554d6d33626210f99441275a96f3fe083e4698f84d50ec7b427ffc864b5ef4cfb
-
SSDEEP
768:7iMEJwABgDq6rMTlBb9vDWqwvKMIe5+Pr:3EJwKg+6rM+
Malware Config
Signatures
-
UAC bypass 3 TTPs 6 IoCs
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
System policy modification 1 TTPs 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9c3f781630b8f58c2cc2f100f91ead21dbbf0fd4f8afe223036b6f2b6f3ff25.exe"C:\Users\Admin\AppData\Local\Temp\c9c3f781630b8f58c2cc2f100f91ead21dbbf0fd4f8afe223036b6f2b6f3ff25.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:/Users/Public/Documents/2022060128.vbe2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\2022060128.vbe"3⤵
-
-
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\k4.exe"C:\Users\Public\Documents\k4.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\c9c3f781630b8f58c2cc2f100f91ead21dbbf0fd4f8afe223036b6f2b6f3ff25.exe"C:\Users\Admin\AppData\Local\Temp\c9c3f781630b8f58c2cc2f100f91ead21dbbf0fd4f8afe223036b6f2b6f3ff25.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:/Users/Public/Documents/2022060128.vbe2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\2022060128.vbe"3⤵
-
-
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\k4.exe"C:\Users\Public\Documents\k4.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD56ebbc35cf59becfc8ecf937455be4dc4
SHA141e9a5db91e55ce62f67970506bd83387f7e648a
SHA256a61b0d0983bc7b9088b734840f0384b653a4275fe3017bb98de5f5e100611543
SHA512842aa11e9fb389d4a52b664d9728f0608aa6f6af2f5c4f71b9a77f2b91d631054c93355afaa9cdc8be7a6def3e3ca65699d05500d48de358b20ba1d93e070eb4
-
Filesize
28KB
MD56ebbc35cf59becfc8ecf937455be4dc4
SHA141e9a5db91e55ce62f67970506bd83387f7e648a
SHA256a61b0d0983bc7b9088b734840f0384b653a4275fe3017bb98de5f5e100611543
SHA512842aa11e9fb389d4a52b664d9728f0608aa6f6af2f5c4f71b9a77f2b91d631054c93355afaa9cdc8be7a6def3e3ca65699d05500d48de358b20ba1d93e070eb4
-
Filesize
28KB
MD56ebbc35cf59becfc8ecf937455be4dc4
SHA141e9a5db91e55ce62f67970506bd83387f7e648a
SHA256a61b0d0983bc7b9088b734840f0384b653a4275fe3017bb98de5f5e100611543
SHA512842aa11e9fb389d4a52b664d9728f0608aa6f6af2f5c4f71b9a77f2b91d631054c93355afaa9cdc8be7a6def3e3ca65699d05500d48de358b20ba1d93e070eb4
-
Filesize
28KB
MD56ebbc35cf59becfc8ecf937455be4dc4
SHA141e9a5db91e55ce62f67970506bd83387f7e648a
SHA256a61b0d0983bc7b9088b734840f0384b653a4275fe3017bb98de5f5e100611543
SHA512842aa11e9fb389d4a52b664d9728f0608aa6f6af2f5c4f71b9a77f2b91d631054c93355afaa9cdc8be7a6def3e3ca65699d05500d48de358b20ba1d93e070eb4
-
Filesize
178B
MD519dcd917cf91e2f9bc6fef28a04adb08
SHA1715c433ca6bc8df6def5adfe14320e28a4bf7052
SHA2560db905ac801366af61ffdd829ecb3a89bcefc9538059ca37ea62161a6d4ca74e
SHA51240df6373bfe3d859d43920d2d6ecc554272028374d4188b43e9d05435863ee99c43e0595d4c8be9198cc5da72093176d86029a414f9020aba264a5daa36e0a0c
-
Filesize
178B
MD519dcd917cf91e2f9bc6fef28a04adb08
SHA1715c433ca6bc8df6def5adfe14320e28a4bf7052
SHA2560db905ac801366af61ffdd829ecb3a89bcefc9538059ca37ea62161a6d4ca74e
SHA51240df6373bfe3d859d43920d2d6ecc554272028374d4188b43e9d05435863ee99c43e0595d4c8be9198cc5da72093176d86029a414f9020aba264a5daa36e0a0c
-
Filesize
178B
MD519dcd917cf91e2f9bc6fef28a04adb08
SHA1715c433ca6bc8df6def5adfe14320e28a4bf7052
SHA2560db905ac801366af61ffdd829ecb3a89bcefc9538059ca37ea62161a6d4ca74e
SHA51240df6373bfe3d859d43920d2d6ecc554272028374d4188b43e9d05435863ee99c43e0595d4c8be9198cc5da72093176d86029a414f9020aba264a5daa36e0a0c
-
Filesize
178B
MD519dcd917cf91e2f9bc6fef28a04adb08
SHA1715c433ca6bc8df6def5adfe14320e28a4bf7052
SHA2560db905ac801366af61ffdd829ecb3a89bcefc9538059ca37ea62161a6d4ca74e
SHA51240df6373bfe3d859d43920d2d6ecc554272028374d4188b43e9d05435863ee99c43e0595d4c8be9198cc5da72093176d86029a414f9020aba264a5daa36e0a0c
-
Filesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
Filesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
Filesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
Filesize
892KB
MD533e29221e2825001d32f78632217d250
SHA19122127fc91790a1edb78003e9b58a9b00355ed5
SHA25665d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d
SHA51201d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93
-
Filesize
1KB
MD5a0f63fb66b28ebb350ec2d349e2d227b
SHA12d4c88e3b973d2f43c7c5246cb03bbbda3030a6b
SHA2569754145aa75a07444aeeb0ef3a7acdeb2254edf1212cb9b3b52c633e7ae0c1e9
SHA5126c69f1788b0ea7979d0462de84f336edd9c0b80e8c33a724079c33f5c10f87bce29b34b8aebc20011def6ee93b827ccfded73f55bbcc521da842d76476a89e2a
-
Filesize
1KB
MD5a0f63fb66b28ebb350ec2d349e2d227b
SHA12d4c88e3b973d2f43c7c5246cb03bbbda3030a6b
SHA2569754145aa75a07444aeeb0ef3a7acdeb2254edf1212cb9b3b52c633e7ae0c1e9
SHA5126c69f1788b0ea7979d0462de84f336edd9c0b80e8c33a724079c33f5c10f87bce29b34b8aebc20011def6ee93b827ccfded73f55bbcc521da842d76476a89e2a