5a9c345a5e2115c21467c2b8331770cd1fd711fa5b32b95552954e12ac5ae138

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a9c345a5e2115c21467c2b8331770cd1fd711fa5b32b95552954e12ac5ae138.exe
Size

136KB
MD5

6f48c222cf4d073a859d0bd4bbfa4ae0
SHA1

f31340ab22873f10d80b642b8fcaefcd4922ec67
SHA256

5a9c345a5e2115c21467c2b8331770cd1fd711fa5b32b95552954e12ac5ae138
SHA512

89dc3db3f74c9ffa956487c62dbdca1ae87ea1067036a53f13f5198be7202675290a8501fbaa40ccf92317c3f59fbd3e1e824e9b5b4077eca308297f7e88640a
SSDEEP

3072:uyNqRmWFvdi1YWvGvZJct7CMpYWn8uGO6HROekGhyrb+4W0q2G:7amwvdiCWvGvPct7CMpY4dpaAeyrsRZ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5a9c345a5e2115c21467c2b8331770cd1fd711fa5b32b95552954e12ac5ae138.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\5a9c345a5e2115c21467c2b8331770cd1fd711fa5b32b95552954e12ac5ae138.exe
"C:\Users\Admin\AppData\Local\Temp\5a9c345a5e2115c21467c2b8331770cd1fd711fa5b32b95552954e12ac5ae138.exe"
1⤵
- Checks computer location settings
PID:4936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4936-132-0x00007FFB846A0000-0x00007FFB850D6000-memory.dmp

Filesize
10.2MB

Download