0a49d8839ecbd2441d1c1a40a592d6a0d6936b46b7a73e449d8e5f05169f2dce

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1ab9fa586883c4d2f7236a4fc52f040.exe
Size 504KB
Sample240224-mtkxcaac6t
SHA256 0a49d8839ecbd2441d1c1a40a592d6a0d6936b46b7a73e449d8e5f05169f2dce
MD5 a1ab9fa586883c4d2f7236a4fc52f040
SHA1 5a0aeaf13a82122e8a66ef2cf826e033e80dfee4
SHA512 6431335edbbd27dd45f95062c6be230f02d223cd4269145e558bb84f0053414a0ae005944a764b33b138132081dca1299d3ad5d0a622d598c9b3ae7a478398b6
SSDEEP 6144:7lZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76lmImxdnxVfFoGVPZ0b53l:7HLUMuiv9RgfSjAzRtymxdnLqGVall
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation	a1ab9fa586883c4d2f7236a4fc52f040.exe

Executes dropped EXE 2 IoCs

pid	Process
2724	Sysbat.exe
1460	Sysbat.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b00000001e597-6.dat	upx
behavioral2/memory/2724-10-0x0000000000400000-0x00000000004F8000-memory.dmp	upx
behavioral2/memory/2724-17-0x0000000000400000-0x00000000004F8000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2724-17-0x0000000000400000-0x00000000004F8000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2724 set thread context of 1460	2724	Sysbat.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000_Classes\Local Settings	a1ab9fa586883c4d2f7236a4fc52f040.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2056	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1460	Sysbat.exe
1460	Sysbat.exe
1460	Sysbat.exe
1460	Sysbat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1604	a1ab9fa586883c4d2f7236a4fc52f040.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2724	1604	a1ab9fa586883c4d2f7236a4fc52f040.exe	87
PID 1604 wrote to memory of 2724	1604	a1ab9fa586883c4d2f7236a4fc52f040.exe	87
PID 1604 wrote to memory of 2724	1604	a1ab9fa586883c4d2f7236a4fc52f040.exe	87
PID 1604 wrote to memory of 2056	1604	a1ab9fa586883c4d2f7236a4fc52f040.exe	88
PID 1604 wrote to memory of 2056	1604	a1ab9fa586883c4d2f7236a4fc52f040.exe	88
PID 1604 wrote to memory of 2056	1604	a1ab9fa586883c4d2f7236a4fc52f040.exe	88
PID 2724 wrote to memory of 1460	2724	Sysbat.exe	89
PID 2724 wrote to memory of 1460	2724	Sysbat.exe	89
PID 2724 wrote to memory of 1460	2724	Sysbat.exe	89
PID 2724 wrote to memory of 1460	2724	Sysbat.exe	89
PID 2724 wrote to memory of 1460	2724	Sysbat.exe	89
PID 2724 wrote to memory of 1460	2724	Sysbat.exe	89
PID 1460 wrote to memory of 3436	1460	Sysbat.exe	76
PID 1460 wrote to memory of 3436	1460	Sysbat.exe	76
PID 1460 wrote to memory of 3436	1460	Sysbat.exe	76
PID 1460 wrote to memory of 3436	1460	Sysbat.exe	76

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436
- C:\Users\Admin\AppData\Local\Temp\a1ab9fa586883c4d2f7236a4fc52f040.exe
  "C:\Users\Admin\AppData\Local\Temp\a1ab9fa586883c4d2f7236a4fc52f040.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\Sysbat.exe
    "C:\Users\Admin\AppData\Local\Temp\Sysbat.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Sysbat.exe
      "C:\Users\Admin\AppData\Local\Temp\Sysbat.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1460
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Macete.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\FirewallControlPanel.dll,ShowWarningDialog "C:\Users\Admin\AppData\Local\Temp\a1ab9fa586883c4d2f7236a4fc52f040.exe"
1⤵
- Modifies registry class
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Macete.txt

Path C:\Users\Admin\AppData\Local\Temp\Macete.txt
Size 137B
SHA256 fc45121d51aa42e4cdbfa6a39c94616eb9820de1de690d9ef4ad3a75cbc86d57
MD5 1be879ed34bdd0fc520d57a737f1e607
SHA1 f0ae7618acad9c6a843de30ce6970a031e256fa7
SHA512 11e8adae0ca40dca2ad29fdfec2fbeb9de59c048c673b0e7616351102757514fc30ff329ffe8db23d1260c58213c2e39686a669776104e7ec3d4c3b64dabaa3c
MD5 SHA1 SHA512

Submit Download

Sysbat.exe

Path C:\Users\Admin\AppData\Local\Temp\Sysbat.exe
Size 492KB
SHA256 f0f185a8815514101c533287ee02751a9b2423a870a6eb0153c35ef47ee0325b
MD5 9c6b54c9889bf1e15769f8d8cb352782
SHA1 8cdf800b09fbdfbbaeea294555c93506cd393397
SHA512 bf5ac529a3ddc11d0a80f251555584a2497ec1cae875ec3feddaaca2d0db1497bc3b8ab6069ba0e4bda62170f778b774e5d7c7d032084cf334b625cf5cd5f559
SSDEEP 6144:vlZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76lmImxdnxVfFoGVPZ0b53R:vHLUMuiv9RgfSjAzRtymxdnLqGValR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1460-13-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1460-16-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1460-19-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1460-23-0x0000000010000000-0x0000000010011000-memory.dmp

Download

memory/1460-27-0x0000000000410000-0x00000000004D9000-memory.dmp

Download

memory/2724-10-0x0000000000400000-0x00000000004F8000-memory.dmp

Download

memory/2724-17-0x0000000000400000-0x00000000004F8000-memory.dmp

Download

memory/3436-20-0x00000000FFFF0000-0x00000000FFFF1000-memory.dmp

Download

memory/3436-22-0x00000000FFFE0000-0x00000000FFFE6000-memory.dmp

Download