c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652

Analysis

max time kernel
210s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe
Size

65KB
MD5

d113a83024f5cd80c67089f0154dc028
SHA1

508479cfed7e073751b20927fecab90de7822efd
SHA256

c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652
SHA512

2fda4a1571beaeaed11fd1ab21045d23532b27478a4278c9f64e8f211e637d933eed95da94306ed6aa07bcbd5e262435fb5339697cf385009ab232c069cc2575
SSDEEP

1536:eN7n+xRckSJqxMyn5Ci6Ju6sq5Dqp42NEI1/2y9nL/z9rp5z:wsoqfn56dsqpqad6pr

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3156-133-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/3156-135-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3156	c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe
3156	c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4560	3156	c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe	80
PID 3156 wrote to memory of 4560	3156	c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe	80
PID 3156 wrote to memory of 4560	3156	c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe	80

C:\Users\Admin\AppData\Local\Temp\c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe
"C:\Users\Admin\AppData\Local\Temp\c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Xcz..bat" > nul 2> nul
  2⤵
  PID:4560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Xcz..bat

Filesize
274B

MD5
30d3cff442c1a9d6b5ed3f9eee404365

SHA1
43d625d7d7aeec80b13f96266596d5e8508416dc

SHA256
c940c6f1f88118c3ab475655978db2c288bee00bc5983c8a0a1b404192a2870b

SHA512
f3fb4781795fd4156dccb7abb62a2124b48488687cb1da16a142635203b46a54f25b3d5ea98f23677598c68ceed49f52201e5b20dad8c3033648c39f5911996b

Download Submit
memory/3156-133-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3156-135-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download