a9027c6070365053c3cb91261991c71f1d3a63707df8467e413847f344b3af4d

Analysis

max time kernel
298s
max time network
320s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2022 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TrashMalwares-main/winnit6.6.6_V6.exe
Size

6.0MB
MD5

acd13b118162f790b36050c3e78f42f6
SHA1

ad9bb7583b0e97d91230016ed03e268caea249ef
SHA256

230c64e86ac91bdeecec4040dc8df3ed11ab116942a08f841c0a093dfe914a37
SHA512

2eba153a5ff21cdf0491e8da8475bbac37b9f4a7755d076388897de2a8c484f05df3b4b3f8f5578ce87c5946c3e57227051a2050bab018ea332f369970d33fe6
SSDEEP

196608:tdGac5D33ZJtKEnD0S6ftqQt5/2FzHo3y:HV8DZHzI/7tMoy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winnit6.6.6_V6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	winnit6.6.6_V6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

winnit6.6.6_V6.exe

description	pid	process	target process
PID 4936 wrote to memory of 4716	4936	winnit6.6.6_V6.exe	cmd.exe
PID 4936 wrote to memory of 4716	4936	winnit6.6.6_V6.exe	cmd.exe
PID 4936 wrote to memory of 4716	4936	winnit6.6.6_V6.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\winnit6.6.6_V6.exe
"C:\Users\Admin\AppData\Local\Temp\TrashMalwares-main\winnit6.6.6_V6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4936

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Games\Doom\temp\doom.bat" "
2⤵
PID:4716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Games\Doom\temp\doom.bat
Filesize
242B

MD5
155927119af096b26cb437881d428cb6

SHA1
9fbb5747e6f3b761766ce85f7da1bb8d9ed9f398

SHA256
3789bad624081aad408a2a2e63a2a177e0adf7656575d1385a399fb14c189497

SHA512
80f79e295bdc2a50ad75284bf066e675899ea0c67cb5932a9ab0810c7fe5688421dab6ef3f69392718ee831544e7944f4d6bf17bc73376b814484b6ac62c684c

Download Submit
memory/4716-132-0x0000000000000000-mapping.dmp

Download