dc3b1cd6cc70e681b959bf718ba3a91ac4d5f6c0dfe49fa6ef0f6a7092a5690d

Analysis

max time kernel
133s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2022, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb14605bdb6b53e1307945ade010e372.exe
Size 2.8MB
Sample220922-s63ktaffam
SHA256 dc3b1cd6cc70e681b959bf718ba3a91ac4d5f6c0dfe49fa6ef0f6a7092a5690d
MD5 fb14605bdb6b53e1307945ade010e372
SHA1 9ee086718138d2b7a052cc3326f8719af7effa3e
SHA512 2bcadaf4d7206ec703e57043ece0f0b5886997a1aec398a61d7ca959910d346a6e3b3e52c035e9d72d4d933cec3f33c20ff27cff2c98c0ce9a548d0f87fe0a9b
SSDEEP 49152:A1Uj263BTMavG41N71dJ0SYNJZyMEh0XwGqXbddmNj9tBL+SEfigAs5I5FGFD:A1Uj263BTnz1xTjk42w1X7Mj9b6LfigZ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4900	project1.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	fb14605bdb6b53e1307945ade010e372.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	project1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	project1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4900	4984	fb14605bdb6b53e1307945ade010e372.exe	80
PID 4984 wrote to memory of 4900	4984	fb14605bdb6b53e1307945ade010e372.exe	80
PID 4984 wrote to memory of 4900	4984	fb14605bdb6b53e1307945ade010e372.exe	80
PID 4900 wrote to memory of 3052	4900	project1.exe	81
PID 4900 wrote to memory of 3052	4900	project1.exe	81
PID 4900 wrote to memory of 3052	4900	project1.exe	81

C:\Users\Admin\AppData\Local\Temp\fb14605bdb6b53e1307945ade010e372.exe
"C:\Users\Admin\AppData\Local\Temp\fb14605bdb6b53e1307945ade010e372.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\project1.exe
  "C:\Users\Admin\AppData\Local\Temp\project1.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
    3⤵
    PID:3052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

run.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs
Size 138B
SHA256 1c364f839821e79fde326f10637bca0ea2bb93aad9859203f74b1c597b4fdb80
MD5 0e029b3f8f6f9e3ed10e5dc413b6096f
SHA1 ed60e574dfd36043b8420dec855d9603542e3377
SHA512 238e628b248f07408d3e5fcb5b263403e960402b847250c5e9e3a03ca937f4d4a45fa48880732a05a6c35256c36c88c493bd05baaf7fbd8253c065d50cdf3ae7
MD5 SHA1 SHA512

Submit Download

project1.exe

Path C:\Users\Admin\AppData\Local\Temp\project1.exe
Size 2.8MB
SHA256 0b46a891301fab6298d53f7276278d4644ff1d263ac5cf71567f614cf2318827
MD5 82cb4d8ea36bdc0edb7328e2a2d8f3c6
SHA1 fd5f075b2ad4ad7a737ed5888f81812226df43bd
SHA512 2a725c7008c93b5367c04305d691aea35add4485bc3e84ab468ae488cebbbe8cb49205d0199e253287e41c115a70012d03f3c4f068e4d469e0aaeeebc3e3042b
SSDEEP 49152:5K3rL57NmcBs88MkncxAthOMvDket2eu6hNJhxirlH8hO4vRJDoJJKznJjbzbNJf:5K3rl7SfdpvDka/hhxklw1QJKzJjbzhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

project1.exe

Path C:\Users\Admin\AppData\Local\Temp\project1.exe
Size 2.8MB
SHA256 0b46a891301fab6298d53f7276278d4644ff1d263ac5cf71567f614cf2318827
MD5 82cb4d8ea36bdc0edb7328e2a2d8f3c6
SHA1 fd5f075b2ad4ad7a737ed5888f81812226df43bd
SHA512 2a725c7008c93b5367c04305d691aea35add4485bc3e84ab468ae488cebbbe8cb49205d0199e253287e41c115a70012d03f3c4f068e4d469e0aaeeebc3e3042b
SSDEEP 49152:5K3rL57NmcBs88MkncxAthOMvDket2eu6hNJhxirlH8hO4vRJDoJJKznJjbzbNJf:5K3rl7SfdpvDka/hhxklw1QJKzJjbzhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads