Analysis
-
max time kernel
90s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 23:23
Static task
static1
Behavioral task
behavioral1
Sample
7c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137.exe
Resource
win10v2004-20220812-en
General
-
Target
7c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137.exe
-
Size
61KB
-
MD5
4342a718afd0f2b7d01f4ab7d5227b40
-
SHA1
bd2911196d29365c8a5d37e2641220231d3e950d
-
SHA256
7c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137
-
SHA512
e1f850cda1fe055abe36a61fad7b4899b046e1bdebd545432fa612779791c81f714d7ae1dbc88b2261fc54a2af2a2f047c8a0a4fadce001af76aa0fd51d65723
-
SSDEEP
1536:kGGodMn63B/f+MZjNl/Vu14lZq19G5Ee:DdMnuB+oNlFyk5Ee
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Trojan.exepid process 1012 Trojan.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 7c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
7c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137.exedescription pid process target process PID 4868 wrote to memory of 1012 4868 7c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137.exe Trojan.exe PID 4868 wrote to memory of 1012 4868 7c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137.exe Trojan.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137.exe"C:\Users\Admin\AppData\Local\Temp\7c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
61KB
MD54342a718afd0f2b7d01f4ab7d5227b40
SHA1bd2911196d29365c8a5d37e2641220231d3e950d
SHA2567c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137
SHA512e1f850cda1fe055abe36a61fad7b4899b046e1bdebd545432fa612779791c81f714d7ae1dbc88b2261fc54a2af2a2f047c8a0a4fadce001af76aa0fd51d65723
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
61KB
MD54342a718afd0f2b7d01f4ab7d5227b40
SHA1bd2911196d29365c8a5d37e2641220231d3e950d
SHA2567c0ac1db102c6f2a98680c67b8438d3d674951a9ea222c8fa65d4d60d3125137
SHA512e1f850cda1fe055abe36a61fad7b4899b046e1bdebd545432fa612779791c81f714d7ae1dbc88b2261fc54a2af2a2f047c8a0a4fadce001af76aa0fd51d65723
-
memory/1012-134-0x0000000000000000-mapping.dmp
-
memory/1012-138-0x00007FFA05EC0000-0x00007FFA06981000-memory.dmpFilesize
10.8MB
-
memory/4868-132-0x0000000000120000-0x0000000000136000-memory.dmpFilesize
88KB
-
memory/4868-133-0x00007FFA05EC0000-0x00007FFA06981000-memory.dmpFilesize
10.8MB
-
memory/4868-137-0x00007FFA05EC0000-0x00007FFA06981000-memory.dmpFilesize
10.8MB