925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c

Analysis

max time kernel
134s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
12-03-2022 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe
Size

9.3MB
MD5

a10948c81c94dfaa2176c58e40ad8c39
SHA1

11a2eb8172e39871e5afac4e7d048667371f1aea
SHA256

925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c
SHA512

bcbddde3d450856cb4324e1015f07e3c2c53dc50ee214b19911b64d5a5922a55687531bfcd93d6f7516874f6fc9fe7493dddbbc231ab55b26ea60d9b384e00cf

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe

description	pid	process	target process
PID 1468 wrote to memory of 2456	1468	925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe	cmd.exe
PID 1468 wrote to memory of 2456	1468	925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe
"C:\Users\Admin\AppData\Local\Temp\925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\373A.tmp\37B8.bat C:\Users\Admin\AppData\Local\Temp\925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe"
2⤵
PID:2456

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\373A.tmp\37B8.bat
MD5
221a5b78e84926beac2c4bbae465eab1

SHA1
dd577cae4cced36a8a827c4f4ffeafb0a7676861

SHA256
fe783973ea583f903ff36bf9af41464356b09e40daa55e129e4fd92a89b4c50a

SHA512
1cc0e1da5b6a1c7a3d37c4361d57440fc7bcbdae416e78ffd9e51076bf13c842b90344beef6b319fc46f8eb0ccc5b05d612d3db088ba7575724ce92614975647

Download Submit