Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
02-04-2023 03:46
General
-
Target
92fb4e56f561a72180c302bcd931e49af7395e3945f7f14d14b4e1d41e5dc442.exe
-
Size
4.8MB
-
MD5
b945c78f3838cfb6c9ac404d68b153b7
-
SHA1
a0f5d36a31e2715737ca74c51848f30d831e96ee
-
SHA256
92fb4e56f561a72180c302bcd931e49af7395e3945f7f14d14b4e1d41e5dc442
-
SHA512
c4a980e3ab27671719e842261791139ad8409c7f376ecc747534888a4fd98b7a43b1426800a0f4d2479946fd5f72334a8debb1592fb812346e2198f3e8774802
-
SSDEEP
98304:aHlkanT+deP0BLPv0VttcfCo0AvYG5kpWP7TbIp1:yVT+BBLnSttcf0AvH5kEzA7
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\92fb4e56f561a72180c302bcd931e49af7395e3945f7f14d14b4e1d41e5dc442.exe"C:\Users\Admin\AppData\Local\Temp\92fb4e56f561a72180c302bcd931e49af7395e3945f7f14d14b4e1d41e5dc442.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Uieiuateoq.dll,start2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 192073⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 4122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4024 -ip 40241⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.4MB
MD54305a9c9f554b9d36605cc682a5d085f
SHA10fd982963faf166d37c318596bb64933c10bedc4
SHA256ede61fb4b35bfd235b09d5ada91a1b7fb96334e9c272d9d26ec9fb94b5e2c891
SHA5125d11110f9719939f86ec4775430448f29b2fae17b57848cebc6e136a6cc708c109a59069a88643c47f897f1eecdba0e65ce91f9c405e42089a7e5f09f02afd17
-
Filesize
5.4MB
MD54305a9c9f554b9d36605cc682a5d085f
SHA10fd982963faf166d37c318596bb64933c10bedc4
SHA256ede61fb4b35bfd235b09d5ada91a1b7fb96334e9c272d9d26ec9fb94b5e2c891
SHA5125d11110f9719939f86ec4775430448f29b2fae17b57848cebc6e136a6cc708c109a59069a88643c47f897f1eecdba0e65ce91f9c405e42089a7e5f09f02afd17
-
Filesize
5.4MB
MD54305a9c9f554b9d36605cc682a5d085f
SHA10fd982963faf166d37c318596bb64933c10bedc4
SHA256ede61fb4b35bfd235b09d5ada91a1b7fb96334e9c272d9d26ec9fb94b5e2c891
SHA5125d11110f9719939f86ec4775430448f29b2fae17b57848cebc6e136a6cc708c109a59069a88643c47f897f1eecdba0e65ce91f9c405e42089a7e5f09f02afd17
-
Filesize
11.3MB
-
Filesize
11.3MB
-
Filesize
4KB
-
Filesize
11.3MB
-
Filesize
5.5MB
-
Filesize
11.3MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
11.3MB
-
Filesize
11.3MB
-
Filesize
4KB
-
Filesize
11.3MB
-
Filesize
1.2MB
-
Filesize
11.3MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
11.3MB
-
Filesize
5.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.7MB
-
Filesize
2.6MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
676KB
-
Filesize
35.2MB
-
Filesize
6.8MB