53a6cb544b2d61ee386a4506ebd471e837210c57f35d694ed4eaa2bd725a58ef

Analysis

max time kernel
128s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53a6cb544b2d61ee386a4506ebd471e837210c57f35d694ed4eaa2bd725a58ef.exe
Size

63KB
MD5

968df8db731792c0f41e591537a10123
SHA1

d766d540ecaa1d9332e3e4139ed5a59f18888a27
SHA256

53a6cb544b2d61ee386a4506ebd471e837210c57f35d694ed4eaa2bd725a58ef
SHA512

7593d06f271cccbbe600cae437fcdb4bc012297c89db9e7aa55efbf9d1bcf13a4e5d4fbe4e34d0dd8a696116bc4bf7cd1e3124dec9e73e79ab7a791d0d2936d2
SSDEEP

1536:uufg6xNUQs0ZEjMPcqHmbBhvI1qWfiuv7tPS0xLDjjk:x3xNvaIPk+qWpL1jjk

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	53a6cb544b2d61ee386a4506ebd471e837210c57f35d694ed4eaa2bd725a58ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 1996	3600	53a6cb544b2d61ee386a4506ebd471e837210c57f35d694ed4eaa2bd725a58ef.exe	80
PID 3600 wrote to memory of 1996	3600	53a6cb544b2d61ee386a4506ebd471e837210c57f35d694ed4eaa2bd725a58ef.exe	80
PID 3600 wrote to memory of 1996	3600	53a6cb544b2d61ee386a4506ebd471e837210c57f35d694ed4eaa2bd725a58ef.exe	80

C:\Users\Admin\AppData\Local\Temp\53a6cb544b2d61ee386a4506ebd471e837210c57f35d694ed4eaa2bd725a58ef.exe
"C:\Users\Admin\AppData\Local\Temp\53a6cb544b2d61ee386a4506ebd471e837210c57f35d694ed4eaa2bd725a58ef.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Bkz..bat" > nul 2> nul
  2⤵
  PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bkz..bat

Filesize
274B

MD5
10064a7b86d678b9c269cdc8b8136bc9

SHA1
0bd049b3f80ef7a30ab233a655eadeac6247f771

SHA256
437980723f9583fd446e929c47ce2d52900dc3a9f00a475896d575c105b058fc

SHA512
b1b1b82d88084e4dc5b1cfdac33a5a97c86550fa5bef7e0f278f322f90cbd78581da264f98a552164b9a6f221e3a0b1768ccd42de21c4b2007e29983621ac3e9

Download Submit
memory/3600-132-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3600-133-0x00000000005A0000-0x00000000005C1000-memory.dmp

Filesize
132KB

Download
memory/3600-134-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3600-136-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download