Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
23-12-2023 22:53
General
-
Target
3a96ec76438d148b5f01e9dbc1b7c72a538cc4e722115ed02532429d11ec92db.exe
-
Size
1.8MB
-
MD5
f3f907603e41a2133b2d629b9f98f372
-
SHA1
82225d5cb4300acfa0a827cb7f40200171ca1c63
-
SHA256
3a96ec76438d148b5f01e9dbc1b7c72a538cc4e722115ed02532429d11ec92db
-
SHA512
b69e6b2ca81a329672769db98abb8ca10d15bb1451ee3ef2df5ea29531285c794a4306ed26d13faca77d2e3c83f2136e3727c9d41c11ff1260cb28e1923c7a09
-
SSDEEP
49152:o7h2DrmHMYyD2hP/MBE7zyZ+ABENWyg+hql:semHGqnM4z0+ABEMyFu
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\3a96ec76438d148b5f01e9dbc1b7c72a538cc4e722115ed02532429d11ec92db.exe"C:\Users\Admin\AppData\Local\Temp\3a96ec76438d148b5f01e9dbc1b7c72a538cc4e722115ed02532429d11ec92db.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a468E.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3a96ec76438d148b5f01e9dbc1b7c72a538cc4e722115ed02532429d11ec92db.exe"C:\Users\Admin\AppData\Local\Temp\3a96ec76438d148b5f01e9dbc1b7c72a538cc4e722115ed02532429d11ec92db.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\CPU-Z\cpuz_x64.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\CPU-Z\cpuz_x64.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Windows\temp\cpuz_driver_1740.log6⤵
- Opens file in notepad (likely ransom note)
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD50c5e863b4f42e3666a8c10967ff5a592
SHA1b1f368bc31b28fe047ba65ff7f15646e853cccc9
SHA2560e47e74aeff65c1fc274fcb519c595232df39a52534e72616fbc2efdf67bfeba
SHA512c21bb24395feea23bd40a91a20cfdae809727c199f25654bcd47c3522c3bbc3cd8574700a1c233083608bd028304b5ef656d0869f0b322bf4d84ccbcb66b38ef
-
Filesize
570KB
MD573cfb732f08a005af2339180540e5ad0
SHA156854432e6898e594b5b5923f909649756010097
SHA25601903b8f69d6f83a229c87d41a85ee136dc5db4da67a6c5efd2de926170d6a80
SHA512986c793c0e84327921548cd1a70f4e98df663e5f0cba6cd2852810d9e5a25af9fb30da0af66f6fe321fcf87fd0f3736584d2a62bf39b7daf0af2a0dd4311f9b1
-
Filesize
481KB
MD51db5b390daa2d070657fbdb4f5d2cc55
SHA177e633e49df484b827080753514cc376749b0ceb
SHA256d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
SHA51268aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
-
Filesize
722B
MD5d52baecab52332312c9cfd91c1c93b4a
SHA14ef7579234b84ca39916db09e963fd357825ed3a
SHA256a921103c13fba602bff1ebba84c068571cc241a7ddeed5c449e3feb39cdfc546
SHA51239959c66eadae716e6ab6f8b9aad9622839f722eb60807e30241dd06021e52bfe3d28efb1f09a486e3f4bcdcba3dc70a369b27e3005227288a82a439af28978d
-
Filesize
1.8MB
MD58df415c002de30c5503e10bebd90e589
SHA1ab9424620ea16ea65c031f10962eeb43d3477427
SHA2567f79d589c3847081988a697fc39a32bda2ef0646070d8a6bc3b0a033f9de46cd
SHA51268065a84ca612721483143c88c6143ba80ad3404f82313f3f5971840ae83e611dc62e6a7868031008eb1730316c87ce80a0f79209ace5e38b75800bf323eb1a3
-
Filesize
610B
MD5b1525c1c4a65d3d12038a94de6110f2e
SHA193cf4da290212076e338631082fe95d03cec1051
SHA25672cdd3d39db6165e2c21dab00dc54dec61d26893d04f555c6a18547f0478b916
SHA512afa790e7661e7a9e121695040ba5eda8903ac58883ea5af216cfb01516979633d36a12febea16edac7d20cfbd6ad62bc16a40896efad139c17ae7806bad91609
-
Filesize
1024KB
MD520ec46b2159ac4fc3e9bed18f34f4484
SHA12d11657068d2d44e79574ee3bd20219cf11167f5
SHA256f3d775e7a7558bcc0a3af23ae2fbf2d6d0693982cd1df0b9b73b32dcd42b6805
SHA5127200fcaeb85dc568d496c81f2dbcfe05cbffb6250d7044e0f6404934f35cdb4cbfbe4969030c08286d98d4672c1241a8771b39e999d2a10228a14606d078448c
-
Filesize
722KB
MD56e8a5a78cc799128941c55320f0c5614
SHA1e7b650ed7ae4d0c9c4c94bdde0fefd50f4f1df31
SHA2564d3bff8ad5b5c8aba8c09fa3ef81ec1c2c07e79d3328d1ba1cc49ffef5966a20
SHA512d3ed9caf4277599cb16aab29b478398741cf1f24cafd7aeea5d9cb844a2d4770da5cb05df7b2df237d3f7ce902efd49059d1b9ff4339a4cbeaf5d4cdee3e0b2b
-
Filesize
880KB
MD5e2a120c385c2a4eebf3bc4cc36316878
SHA1563e73e4b46fb14a6285d60df2c0d6a52e4efd27
SHA2565e068f88a6fb2f3a3a4a52619c56f76f037d72dde07ce45fe4650cf8eb8438b5
SHA512d038fd83ab608332706ace4d5caa4a2035e662e7d4f67156a6faed7996f009990d6038602795907b2a4294371ba6adf9e6bfcc80956ce2733db7140c019672f7
-
Filesize
26KB
MD5fb93094f20bbc5dcb79268d23f38361c
SHA1516b8b78319dc3f2adbe7e4de6a4e3fba41ae76a
SHA256cf70d1c51b86031f36294c54caa11f02cd09e2b82fcd286240809891c7a82eff
SHA512ceeb1988199292d7792ebff568e7bb89f49b628e5df409432b2263752de9142f00101f2bfe1bfc44321ed7934e70a1bf02f9823be43a1ee0e7ea52c504ab3d0f
-
Filesize
2KB
MD50d0332a76c5e522cfdfc593c4b48971c
SHA1718fed21b637f915cbae66e78ddde8ba567a89ad
SHA2562f67a87914f494e0f96675e31b3550ddb2c891ff0886232bdf727fe83039f285
SHA512fcc5d3d81a1e86b97a4fdb2a2282d010c176385026ef85ddd901288bd154fd359184ffb579fd0915a5726228b76cfbf0d77e4aa2e07a3438fa7343231db2c1c2
-
Filesize
10B
MD57ffaa74dcf5b57082a43c17464e10782
SHA1c6cf002ebb82e54cb14553d044f6c61463b369a6
SHA256b3bfda52765f0ec02320ef68e5fca5e0d4bb61e1ec6f062430a5711a41c1be65
SHA51235ef0f681e44781b5dc20e179918be9dad7be2029093f9537cfe30bff888bc875ad32e6bbb59294dc36779829bab7aa6ebfac9e93c6a1ef5e4e7ddde85bb6de8
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
208KB
-
Filesize
176KB
-
Filesize
176KB