Analysis
-
max time kernel
132s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
24-03-2022 03:12
Static task
static1
Behavioral task
behavioral1
Sample
Scan0186460022.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Scan0186460022.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Scan0186460022.exe
-
Size
28KB
-
MD5
4fcb4c25f8c90512688e83cdc8daf8b3
-
SHA1
256bb873dcfa16fade3e911cb348b217df8b389f
-
SHA256
1668071dae27e79c5de1abc1d04e278ce9ffe980fd36fa194e9d32ab00ac6831
-
SHA512
f6544e3212c721d93d631dc9b9d367080383bc9b036cf1fd7a4cccf5c53b6c6118d922607aee109f28a4c3342bc0763791c968f4b721a2774c7ba800b68fc70e
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Scan0186460022.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation Scan0186460022.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4660 timeout.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Scan0186460022.execmd.exedescription pid process target process PID 3084 wrote to memory of 1256 3084 Scan0186460022.exe cmd.exe PID 3084 wrote to memory of 1256 3084 Scan0186460022.exe cmd.exe PID 3084 wrote to memory of 1256 3084 Scan0186460022.exe cmd.exe PID 1256 wrote to memory of 4660 1256 cmd.exe timeout.exe PID 1256 wrote to memory of 4660 1256 cmd.exe timeout.exe PID 1256 wrote to memory of 4660 1256 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan0186460022.exe"C:\Users\Admin\AppData\Local\Temp\Scan0186460022.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout -t 15 -nobreak && ping google.com2⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\timeout.exetimeout -t 15 -nobreak3⤵
- Delays execution with timeout.exe
PID:4660