6b4490d95d0cc8f76ef46bb89c223d2d9242c05da8426a074d8a53b8f66ef559

Analysis

max time kernel
88s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b4490d95d0cc8f76ef46bb89c223d2d9242c05da8426a074d8a53b8f66ef559.exe
Size

28KB
MD5

a84c4760fa1db4598e5331dd82686a67
SHA1

55607ee1a88818dfa3ed29bd6e23763555859479
SHA256

6b4490d95d0cc8f76ef46bb89c223d2d9242c05da8426a074d8a53b8f66ef559
SHA512

2b7cbb2468755645d3740da6f0b83ccb2713a97e6e12082bafdb0846f7ea9a03ba66e859d1ffebf3da85c4a23d7daf6ff4a160fe66d6d5163da88570323f78d3
SSDEEP

768:qgE+xN3QmZwEtvL+JBWB9R0I23dHpBA3ZC:qgE+xNAItv6JIbefFXA0

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4832-132-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/4832-134-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	6b4490d95d0cc8f76ef46bb89c223d2d9242c05da8426a074d8a53b8f66ef559.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 208	4832	6b4490d95d0cc8f76ef46bb89c223d2d9242c05da8426a074d8a53b8f66ef559.exe	87
PID 4832 wrote to memory of 208	4832	6b4490d95d0cc8f76ef46bb89c223d2d9242c05da8426a074d8a53b8f66ef559.exe	87
PID 4832 wrote to memory of 208	4832	6b4490d95d0cc8f76ef46bb89c223d2d9242c05da8426a074d8a53b8f66ef559.exe	87

C:\Users\Admin\AppData\Local\Temp\6b4490d95d0cc8f76ef46bb89c223d2d9242c05da8426a074d8a53b8f66ef559.exe
"C:\Users\Admin\AppData\Local\Temp\6b4490d95d0cc8f76ef46bb89c223d2d9242c05da8426a074d8a53b8f66ef559.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  PID:208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
274B

MD5
76ccc43a79643f424aa137d8e2fa9f55

SHA1
bb593de1a4f95ad20ae24e40d5808e86c8c3aedc

SHA256
20bfb0a92496c0b647c1cefeec8321a883acf4bd6e94a77ca34728fd59955ef7

SHA512
e5ff43451be5fd78bc1146b70ff965bc2dec059e8347f1e36ecdb49c5d68da92e8164321a98df421ce01558d7577bd742bc65e7671d38c61086ac3178170a42e

Download Submit
memory/4832-132-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4832-134-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download