904f29d18a2e624fdff3e46eb8aeef598c74304e9f763d26dcf4fc946812f9e5

Analysis

max time kernel
24s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20/01/2022, 11:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4rodtz.exe
Size 174KB
Sample220120-n5rdyahgh8
SHA256 904f29d18a2e624fdff3e46eb8aeef598c74304e9f763d26dcf4fc946812f9e5
MD5 233cb586e29201d80a88a4dda7b8dfc4
SHA1 afc024a8eae4c9afc3a3778a77a60dd9cd29f069
SHA512 d30f2376e9548300cf367f93c7bd6bcb0c49de44bc6be20cbbe41a31ecfead205cff9e7aae9c57691a0d81788e36c9cbecb9f3503f3d69968739badfc266193f
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	4rodtz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3680	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4004	3980	4rodtz.exe	54
PID 3980 wrote to memory of 4004	3980	4rodtz.exe	54
PID 3980 wrote to memory of 4004	3980	4rodtz.exe	54
PID 4004 wrote to memory of 3680	4004	cmd.exe	57
PID 4004 wrote to memory of 3680	4004	cmd.exe	57
PID 4004 wrote to memory of 3680	4004	cmd.exe	57

C:\Users\Admin\AppData\Local\Temp\4rodtz.exe
"C:\Users\Admin\AppData\Local\Temp\4rodtz.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SysWOW64\PING.EXE
    ping google.com
    3⤵
    - Runs ping.exe
    PID:3680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3980-130-0x00000000001B0000-0x00000000001E0000-memory.dmp

Download