7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe
Size

264KB
MD5

8a76938eac3960939b0d96caad0ca670
SHA1

51d1aa88fde35179946498085c25f46edd9962c3
SHA256

7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d
SHA512

94912e8bfaca344c52c953539e289d0758c5727c56b90270ec6e88b95124613b57f5880e010861998bc9574eb4b5299d2e5425a28ba4b6a99ab6bd491fad5d57
SSDEEP

3072:b1dlKwgj23+Oz05YoNozDv4Vh97i4Liu5Z611359z9pN7qJtt7KrbX4Zb8P8o1w5:b1dlZro5yDAV1iuLQ3tN7q1c8+PVB0Z

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2256	s1a4a.exe
3588	s1a4a.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2256 set thread context of 3588	2256	s1a4a.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Extracted\æLoQ‰²ªFÈµÓ‚=\|ä¤\LÝoÅ †Š'“,8N9’ \Eò,\"¤3Ü†Ê„Ê„BDÛ, uŽõ4ÔÄwýïK©Â£'›³²HN j{œUr9È›T¦ZjQÅæeh™’K,ãÚ*ê3¨£G"C®#Ø÷k¼^¬[h‚ëÎ‚$Jš™í]Ðº¹¹‘)Ttõµb]d••Ç"ó†îŽZøž=Àu2e}\k»Rájƒ\|:Ê·,…«ëXÿ	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3588	s1a4a.exe
3588	s1a4a.exe
3588	s1a4a.exe
3588	s1a4a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2256	s1a4a.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 2256	4824	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe	80
PID 4824 wrote to memory of 2256	4824	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe	80
PID 4824 wrote to memory of 2256	4824	7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe	80
PID 2256 wrote to memory of 3588	2256	s1a4a.exe	81
PID 2256 wrote to memory of 3588	2256	s1a4a.exe	81
PID 2256 wrote to memory of 3588	2256	s1a4a.exe	81
PID 2256 wrote to memory of 3588	2256	s1a4a.exe	81
PID 2256 wrote to memory of 3588	2256	s1a4a.exe	81
PID 2256 wrote to memory of 3588	2256	s1a4a.exe	81
PID 2256 wrote to memory of 3588	2256	s1a4a.exe	81
PID 3588 wrote to memory of 2976	3588	s1a4a.exe	41
PID 3588 wrote to memory of 2976	3588	s1a4a.exe	41
PID 3588 wrote to memory of 2976	3588	s1a4a.exe	41
PID 3588 wrote to memory of 2976	3588	s1a4a.exe	41

C:\Users\Admin\AppData\Local\Temp\7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe
"C:\Users\Admin\AppData\Local\Temp\7fd840f4f1f0732daa5fa3e244c8d62c797be9582ea141e464ee6a57a764a25d.exe"
1⤵
- Checks computer location settings
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Extracted\s1a4a.exe
  "C:\Extracted\s1a4a.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Extracted\s1a4a.exe
    C:\Extracted\s1a4a.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3588

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Extracted\s1a4a.exe

Filesize
200KB

MD5
ae9e89e9eef61cb8225e451f03e6dbaf

SHA1
28e86646bc4ca8fb7eca376bf6fc1437e7703a39

SHA256
c262f836d430743c0c1a1dfba4f8f1da376b95a8d1cf1a632c8cdd8d31b6ee76

SHA512
fb55f6779f695862ec680986f61b3536b67693eba2af48b6124215916b7e0f2ddb1db8cdd085ed1c8f979282a147862d357d3b9c803ec03a5dc004463f87c5ba

Download Submit
C:\Extracted\s1a4a.exe

Filesize
200KB

MD5
ae9e89e9eef61cb8225e451f03e6dbaf

SHA1
28e86646bc4ca8fb7eca376bf6fc1437e7703a39

SHA256
c262f836d430743c0c1a1dfba4f8f1da376b95a8d1cf1a632c8cdd8d31b6ee76

SHA512
fb55f6779f695862ec680986f61b3536b67693eba2af48b6124215916b7e0f2ddb1db8cdd085ed1c8f979282a147862d357d3b9c803ec03a5dc004463f87c5ba

Download Submit
C:\Extracted\s1a4a.exe

Filesize
200KB

MD5
ae9e89e9eef61cb8225e451f03e6dbaf

SHA1
28e86646bc4ca8fb7eca376bf6fc1437e7703a39

SHA256
c262f836d430743c0c1a1dfba4f8f1da376b95a8d1cf1a632c8cdd8d31b6ee76

SHA512
fb55f6779f695862ec680986f61b3536b67693eba2af48b6124215916b7e0f2ddb1db8cdd085ed1c8f979282a147862d357d3b9c803ec03a5dc004463f87c5ba

Download Submit
memory/2976-142-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3588-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3588-141-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/3588-143-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download