314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b

Analysis

max time kernel
157s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11-05-2022 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b.exe
Size

737KB
MD5

091594da96c121bd3e18c5a85bfe27c1
SHA1

2e67b46334e1b1aae5c27c919f517ba759c00ce4
SHA256

314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b
SHA512

19cfa75ecfc71e8dd32fc8af6639bf6c0bbb67665e5010754c38b68eae7ccae59fb4ac2852f5b7776661b69975fbdb025c629a919fffbc56bc1c5ba0d4bb2e1a

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4604	314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4604	314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b.exe
Token: SeCreatePagefilePrivilege	4604	314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4380	4604	314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b.exe	81
PID 4604 wrote to memory of 4380	4604	314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b.exe	81
PID 4604 wrote to memory of 4380	4604	314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b.exe	81

C:\Users\Admin\AppData\Local\Temp\314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b.exe
"C:\Users\Admin\AppData\Local\Temp\314f0b21f24f66667f7368e97ab3074508efe5ee811e5984ab4d884fccdc6f3b.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FQdb4LVzwF3A9iWQ.bat" "
  2⤵
  PID:4380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FQdb4LVzwF3A9iWQ.bat

Filesize
204B

MD5
c503c9f6bb750e59735821b5e9877be4

SHA1
f397af4f74b414fac336ede27281a5e253f960a3

SHA256
e986c7d4ca70dfa0696386dee00c4d9044032f62c98a321030ea476859f7d9f3

SHA512
9efb67feab6eed8876a23a825dfd2f2f0bbad4934df7e46e5ff20c07e418a247914edb08b55c82f9b93ea3150832ae5373bc808eb12808bc9bfa6433bfef705f

Download Submit