222ba8c80f546fb4ccaca981f2a9fb3da9e76e361cf6ba1d9b2f7d3df6dd52c9

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2022, 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

222ba8c80f546fb4ccaca981f2a9fb3da9e76e361cf6ba1d9b2f7d3df6dd52c9.exe
Size

2.0MB
MD5

b46181f338bdc82a2b563738096e2c41
SHA1

d2681ed72f2f7bc5715106eb5c32c65c609ec647
SHA256

222ba8c80f546fb4ccaca981f2a9fb3da9e76e361cf6ba1d9b2f7d3df6dd52c9
SHA512

f485e6069d573f95744cd18198b90e99972ec9b5af212c7474a5d9c304f089fed03ce2ef029fbabdc9be5abb6a5340e965414454c05f04911c5cf2549abb03f9
SSDEEP

49152:/eZBYBfJXAEM+SgouTJxeY3kkFhda8+kB7spDj2U6MtqXB:/eZBYBfKEM+SbuTjdkA/+kBUvzns

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	222ba8c80f546fb4ccaca981f2a9fb3da9e76e361cf6ba1d9b2f7d3df6dd52c9.exe

Loads dropped DLL 1 IoCs

pid	Process
4036	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4036	4968	222ba8c80f546fb4ccaca981f2a9fb3da9e76e361cf6ba1d9b2f7d3df6dd52c9.exe	81
PID 4968 wrote to memory of 4036	4968	222ba8c80f546fb4ccaca981f2a9fb3da9e76e361cf6ba1d9b2f7d3df6dd52c9.exe	81
PID 4968 wrote to memory of 4036	4968	222ba8c80f546fb4ccaca981f2a9fb3da9e76e361cf6ba1d9b2f7d3df6dd52c9.exe	81

C:\Users\Admin\AppData\Local\Temp\222ba8c80f546fb4ccaca981f2a9fb3da9e76e361cf6ba1d9b2f7d3df6dd52c9.exe
"C:\Users\Admin\AppData\Local\Temp\222ba8c80f546fb4ccaca981f2a9fb3da9e76e361cf6ba1d9b2f7d3df6dd52c9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" -Y .\pNgKf.7p
  2⤵
  - Loads dropped DLL
  PID:4036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pNgKf.7p

Filesize
1.8MB

MD5
c820affae9b0d120a93f48fd4a754ff2

SHA1
20afd2da244d8f90f4efe41cc04169bf5eea9f3d

SHA256
580fbffc663a0bcacad0d1af4dbac083551be62b23e46aa410291d2fa767b5e8

SHA512
7241f975596dc94c3e8a71a3a1f2dcdde4e20ea3924eb233dda8a562da01bac554e72e7d3f6191dade2241c7a5f78a102378ebf5ca3c2ba72257fe24e86c43f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\pNgKf.7p

Filesize
1.8MB

MD5
c820affae9b0d120a93f48fd4a754ff2

SHA1
20afd2da244d8f90f4efe41cc04169bf5eea9f3d

SHA256
580fbffc663a0bcacad0d1af4dbac083551be62b23e46aa410291d2fa767b5e8

SHA512
7241f975596dc94c3e8a71a3a1f2dcdde4e20ea3924eb233dda8a562da01bac554e72e7d3f6191dade2241c7a5f78a102378ebf5ca3c2ba72257fe24e86c43f7

Download Submit
memory/4036-136-0x0000000002EE0000-0x0000000002FE6000-memory.dmp

Filesize
1.0MB

Download
memory/4036-135-0x0000000002C90000-0x0000000002DCF000-memory.dmp

Filesize
1.2MB

Download
memory/4036-137-0x0000000002FF0000-0x00000000030B2000-memory.dmp

Filesize
776KB

Download
memory/4036-138-0x00000000030C0000-0x000000000316D000-memory.dmp

Filesize
692KB

Download
memory/4036-141-0x0000000002EE0000-0x0000000002FE6000-memory.dmp

Filesize
1.0MB

Download