7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b

Analysis

max time kernel
80s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe
Size

143KB
MD5

999ed0b558534e9fffcf081626c63313
SHA1

fe62e76a23edae3d46623476cb5ea0770e1d36b3
SHA256

7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b
SHA512

d6661cc8c1ba6def71bb087132a9d041480aae5889293742c7bcc174112f31794aa87ffea26e65d96a365dc687be3594bf68850449fa882b2c0dd87ac5da6cf0
SSDEEP

1536:yL+hPQzDGDm8VjJU+ncIRE7/zp1wzBrz4:bPYDGDljJUaccC/0dQ

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1412-132-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral2/memory/1412-134-0x0000000000400000-0x0000000000479000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1412	7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe
1412	7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 4032	1412	7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe	83
PID 1412 wrote to memory of 4032	1412	7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe	83
PID 1412 wrote to memory of 4032	1412	7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe	83

C:\Users\Admin\AppData\Local\Temp\7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe
"C:\Users\Admin\AppData\Local\Temp\7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  PID:4032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
274B

MD5
83ea40d5ba00a744e444d9b6c1e4b256

SHA1
173e12eaa5e0c29c3627b317aaf1abc655f66f9c

SHA256
2a641899741a17ec3e453adef69b8a93d1c058bfde65bbbe796e1e692a9a7416

SHA512
337bb79d324412fc416e06dd50d623bb1b325cc18c88f5111ec4f50bec4ada1bea4c076a4c9e5f4e06d5b458ee14ee8654d1c724310df19f0285558d9d5befc9

Download Submit
memory/1412-132-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1412-134-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download