0d17f15ac8cc5edfacfeec9330647c759379dc143bd9fd55ef7140297aa57b05

Analysis

max time kernel
132s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d17f15ac8cc5edfacfeec9330647c759379dc143bd9fd55ef7140297aa57b05.exe
Size

18KB
MD5

6fb05fcea11bd67403a29e2ceb6d7bb0
SHA1

e8fc6ed6657a3c94c313f69dec7a16ff9f7721bf
SHA256

0d17f15ac8cc5edfacfeec9330647c759379dc143bd9fd55ef7140297aa57b05
SHA512

fbdd575633e7b56228b902dd4fe5268c89883aff05dafacb332e8707e6534be112001dc39b213bfb34db79d330415a9fa68e9e7004831ecc6cafdafafd379db7
SSDEEP

192:nybK1GyeZuVIocBkAs4bdNFV1gSD1FcfJANOjQm8UtgLCVNEMZX:nN8CcBkj4bdNFP5D1aGOUUS6H

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5080	updtool.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	0d17f15ac8cc5edfacfeec9330647c759379dc143bd9fd55ef7140297aa57b05.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 5080	1520	0d17f15ac8cc5edfacfeec9330647c759379dc143bd9fd55ef7140297aa57b05.exe	82
PID 1520 wrote to memory of 5080	1520	0d17f15ac8cc5edfacfeec9330647c759379dc143bd9fd55ef7140297aa57b05.exe	82
PID 1520 wrote to memory of 5080	1520	0d17f15ac8cc5edfacfeec9330647c759379dc143bd9fd55ef7140297aa57b05.exe	82

C:\Users\Admin\AppData\Local\Temp\0d17f15ac8cc5edfacfeec9330647c759379dc143bd9fd55ef7140297aa57b05.exe
"C:\Users\Admin\AppData\Local\Temp\0d17f15ac8cc5edfacfeec9330647c759379dc143bd9fd55ef7140297aa57b05.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\updtool.exe
  "C:\Users\Admin\AppData\Local\Temp\updtool.exe"
  2⤵
  - Executes dropped EXE
  PID:5080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\updtool.exe

Filesize
18KB

MD5
9d0e49ea81a4b17f56f04a1aa0ea35d0

SHA1
8feb3390c431e3a8fb2c72767b8feb323c1005d1

SHA256
bd8052a9043b3efb95ebfe07b030f267e63e2c3915393e606b2ea277da2d893d

SHA512
4e2349364d703a204d1a949c5069d4a7da711ef236ed3a1351cdfc244e86bb240b6ca325294b6cedab56a0e0bd0c08277180861463307c72708f647f2db3acf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\updtool.exe

Filesize
18KB

MD5
9d0e49ea81a4b17f56f04a1aa0ea35d0

SHA1
8feb3390c431e3a8fb2c72767b8feb323c1005d1

SHA256
bd8052a9043b3efb95ebfe07b030f267e63e2c3915393e606b2ea277da2d893d

SHA512
4e2349364d703a204d1a949c5069d4a7da711ef236ed3a1351cdfc244e86bb240b6ca325294b6cedab56a0e0bd0c08277180861463307c72708f647f2db3acf5

Download Submit
memory/1520-132-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/1520-133-0x0000000004000000-0x0000000004005000-memory.dmp

Filesize
20KB

Download
memory/5080-134-0x0000000000000000-mapping.dmp

Download