1668071dae27e79c5de1abc1d04e278ce9ffe980fd36fa194e9d32ab00ac6831

Analysis

max time kernel
132s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
24-03-2022 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Scan0186460022.exe
Size

28KB
MD5

4fcb4c25f8c90512688e83cdc8daf8b3
SHA1

256bb873dcfa16fade3e911cb348b217df8b389f
SHA256

1668071dae27e79c5de1abc1d04e278ce9ffe980fd36fa194e9d32ab00ac6831
SHA512

f6544e3212c721d93d631dc9b9d367080383bc9b036cf1fd7a4cccf5c53b6c6118d922607aee109f28a4c3342bc0763791c968f4b721a2774c7ba800b68fc70e

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Scan0186460022.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	Scan0186460022.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4660 timeout.exe

pid	process
4660	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Scan0186460022.execmd.exe

description	pid	process	target process
PID 3084 wrote to memory of 1256	3084	Scan0186460022.exe	cmd.exe
PID 3084 wrote to memory of 1256	3084	Scan0186460022.exe	cmd.exe
PID 3084 wrote to memory of 1256	3084	Scan0186460022.exe	cmd.exe
PID 1256 wrote to memory of 4660	1256	cmd.exe	timeout.exe
PID 1256 wrote to memory of 4660	1256	cmd.exe	timeout.exe
PID 1256 wrote to memory of 4660	1256	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\Scan0186460022.exe
"C:\Users\Admin\AppData\Local\Temp\Scan0186460022.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout -t 15 -nobreak && ping google.com
2⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\timeout.exe
timeout -t 15 -nobreak
3⤵
- Delays execution with timeout.exe
PID:4660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-136-0x0000000000000000-mapping.dmp

Download
memory/3084-134-0x0000000000C10000-0x0000000000C1E000-memory.dmp

Filesize
56KB

Download
memory/3084-135-0x0000000005BB0000-0x0000000006154000-memory.dmp

Filesize
5.6MB

Download
memory/4660-137-0x0000000000000000-mapping.dmp

Download