1ec850a570549c3775cc48804b38ac19b9fdafa67abeaa532eee989cc9a39773

Analysis

max time kernel
85s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2022, 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ec850a570549c3775cc48804b38ac19b9fdafa67abeaa532eee989cc9a39773.exe
Size

250KB
MD5

8ee7d7b83377f0f30925b208218e4a9d
SHA1

76ad386232409ff107b9e00065cfb1692f9749bf
SHA256

1ec850a570549c3775cc48804b38ac19b9fdafa67abeaa532eee989cc9a39773
SHA512

2461c6398cde7c8e07d79b61175731ecf27a3eb839ff69ff5edd462a9fc04a4e41ef3063257320126eb2b11336f622623db36999306b4b0bb575a34cb972ae5b
SSDEEP

6144:Wc0h522p3l04ZMSmIp3Uy28uhyCtFAo3j:Qhxp3lZnT9bD5o3j

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1ec850a570549c3775cc48804b38ac19b9fdafa67abeaa532eee989cc9a39773.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs .reg file with regedit 1 IoCs

pid	Process
4548	regedit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 4548	1688	1ec850a570549c3775cc48804b38ac19b9fdafa67abeaa532eee989cc9a39773.exe	82
PID 1688 wrote to memory of 4548	1688	1ec850a570549c3775cc48804b38ac19b9fdafa67abeaa532eee989cc9a39773.exe	82
PID 1688 wrote to memory of 4548	1688	1ec850a570549c3775cc48804b38ac19b9fdafa67abeaa532eee989cc9a39773.exe	82

C:\Users\Admin\AppData\Local\Temp\1ec850a570549c3775cc48804b38ac19b9fdafa67abeaa532eee989cc9a39773.exe
"C:\Users\Admin\AppData\Local\Temp\1ec850a570549c3775cc48804b38ac19b9fdafa67abeaa532eee989cc9a39773.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s C:\Users\Admin\AppData\Local\Temp\20h2lol.reg
  2⤵
  - Runs .reg file with regedit
  PID:4548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\20h2lol.reg

Filesize
307B

MD5
f7208da6784d2169b46811985d82eee7

SHA1
c08df227fd9cf670ad635db12efe0bf9874eaf0b

SHA256
db92230a95fdb9a9740228a7b1b2ce3be0328f28d92018b7dcb75d3af1e81700

SHA512
f4a2541c5e4937bbb606cff19f65abb9656a0c91344c105da94a86b264a4dd6623fd1424271f39bf15abf08caf0606fe17b0bea60315d54edea1c26eac7c2831

Download Submit