5ee64a5566ba4a3519fe9b5af19fe836da42041f7967df9c347e12d9fc8601ba

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ee64a5566ba4a3519fe9b5af19fe836da42041f7967df9c347e12d9fc8601ba.exe
Size

63KB
MD5

e779af86b872865f9b5024ac3da5c511
SHA1

2f7f97b15d76023fdd2efb33495b7d5afdb6cbb8
SHA256

5ee64a5566ba4a3519fe9b5af19fe836da42041f7967df9c347e12d9fc8601ba
SHA512

773e44d31b01a307b0e16412bca5d83f3b91e43559b3c9726be31e1f4daa33167a6e57c7b30c4ddb067afab9067ff76fff5a72bb1ebc14b2b60a18d141a7dc1c
SSDEEP

1536:uufg6xNUQs0ZEjMPcqHmbBhvI1qWfiuv7tPS0xLD/k:x3xNvaIPk+qWpL1/k

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	5ee64a5566ba4a3519fe9b5af19fe836da42041f7967df9c347e12d9fc8601ba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 5068	5084	5ee64a5566ba4a3519fe9b5af19fe836da42041f7967df9c347e12d9fc8601ba.exe	79
PID 5084 wrote to memory of 5068	5084	5ee64a5566ba4a3519fe9b5af19fe836da42041f7967df9c347e12d9fc8601ba.exe	79
PID 5084 wrote to memory of 5068	5084	5ee64a5566ba4a3519fe9b5af19fe836da42041f7967df9c347e12d9fc8601ba.exe	79

C:\Users\Admin\AppData\Local\Temp\5ee64a5566ba4a3519fe9b5af19fe836da42041f7967df9c347e12d9fc8601ba.exe
"C:\Users\Admin\AppData\Local\Temp\5ee64a5566ba4a3519fe9b5af19fe836da42041f7967df9c347e12d9fc8601ba.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Wrp..bat" > nul 2> nul
  2⤵
  PID:5068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wrp..bat

Filesize
274B

MD5
3da8edc32685010efd32da506fa40555

SHA1
de0b1ec7026c6bb082ee2ef3a423d437d79ed98c

SHA256
34656a325dbc56c1a9b93a74e80530e96a0b8c4bae0b9833a2951727dcca2b76

SHA512
f96c97436333c56c49485974bad59fd8d38fc5769a320b338f6d5bf54fe2353e81a1e266b74600e4f0e065b26703b2fda1c620461ae3c41f541274eb81d218bc

Download Submit
memory/5084-132-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/5084-133-0x00000000005B0000-0x00000000005D1000-memory.dmp

Filesize
132KB

Download
memory/5084-134-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/5084-136-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download