fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a

Analysis

max time kernel
144s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe
Size

114KB
MD5

718150b242a6a4212fb442c8778f4710
SHA1

d13aca4c7cf92989f86f51f603a963cc76298cc5
SHA256

fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a
SHA512

49037fc75b01b8101ad007943fced3c921ef922c0efebe3a3d27a77a5f8b993634d434bac2916314f8ff39278babe656ff9e31478c008a09e8eb278fe5ecfffd
SSDEEP

1536:XXSKvDz+asR2EPeJ+LZCsqBK30yYqUgb+/5qzRteuZfpAXcVIleqBzh7fsXn4eZ9:HsLPFkbSoNE7lQu7E2bFWY1AE9Tca

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4360	4632	fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe	81
PID 4632 wrote to memory of 4360	4632	fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe	81
PID 4632 wrote to memory of 4360	4632	fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe	81

C:\Users\Admin\AppData\Local\Temp\fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe
"C:\Users\Admin\AppData\Local\Temp\fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ecz..bat" > nul 2> nul
  2⤵
  PID:4360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ecz..bat

Filesize
274B

MD5
20d8d2098b7ae2655dee11711e129ec7

SHA1
22bbcb6e584c3e541ea582d1b0aa1ab7b0b5d1ee

SHA256
9679134fee910dfca4f313e5f42889094d0a3dddbccae7825595ca28fca536dc

SHA512
db6fff1a7c0dba0b5dac36ba1f7e77d26437cbeb7b529de6137b7b39133611a202c23d8982ca97682214bca887448f9f2296b287380f17b324b192dfa1e65b29

Download Submit
memory/4632-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4632-134-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download