c630b9e304b5e90d97f12c3c9fc90d7ed2aa0446f58ea074f4f3982e77719ff3

Analysis

max time kernel
124s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c630b9e304b5e90d97f12c3c9fc90d7ed2aa0446f58ea074f4f3982e77719ff3.exe
Size

23KB
MD5

d3aab7509bf179e1aed9fb618819b841
SHA1

48e03ecbb164050b54270a33d2d64bf0dfecc712
SHA256

c630b9e304b5e90d97f12c3c9fc90d7ed2aa0446f58ea074f4f3982e77719ff3
SHA512

1b16f6e8bca026264be7c3696fcaaed46023add30ffc326139eb4c5a9411a06bb036e1337475459ed838911d6af6b531533d0fb5903cbc6d6b8bc2aeca0a6655
SSDEEP

384:HPXwKqXL3+pfivFNeYVxZ+HiPYrdMck+G7s31/tGh/zJP8pFfJshiruPNzUdDr9y:HIKqXL3EfivneYLwWYrdMckXsFF4JUph

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	c630b9e304b5e90d97f12c3c9fc90d7ed2aa0446f58ea074f4f3982e77719ff3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1944	c630b9e304b5e90d97f12c3c9fc90d7ed2aa0446f58ea074f4f3982e77719ff3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 3096	1944	c630b9e304b5e90d97f12c3c9fc90d7ed2aa0446f58ea074f4f3982e77719ff3.exe	89
PID 1944 wrote to memory of 3096	1944	c630b9e304b5e90d97f12c3c9fc90d7ed2aa0446f58ea074f4f3982e77719ff3.exe	89
PID 1944 wrote to memory of 3096	1944	c630b9e304b5e90d97f12c3c9fc90d7ed2aa0446f58ea074f4f3982e77719ff3.exe	89

C:\Users\Admin\AppData\Local\Temp\c630b9e304b5e90d97f12c3c9fc90d7ed2aa0446f58ea074f4f3982e77719ff3.exe
"C:\Users\Admin\AppData\Local\Temp\c630b9e304b5e90d97f12c3c9fc90d7ed2aa0446f58ea074f4f3982e77719ff3.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C630B9~1.EXE > nul
  2⤵
  PID:3096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-132-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1944-133-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1944-134-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download