7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e

Analysis

max time kernel
167s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe
Size

1.0MB
MD5

6575b134dd7b050d597ef0475d0e1585
SHA1

6fbc76429ccbbf9dbdee4c86b1d61f612e70f60e
SHA256

7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e
SHA512

8628530230d14ad428d0c28bfd0e9363858c44b95a614127e7a57c284c605be19e7e6d0a5b4b5ccfdad5135f670507b23238d507c0e4e05891d05dd0e9de3014
SSDEEP

24576:MQCMf3oQlibOIQxiZY1Oa7RlOoIT40sAZw8Ts:UMPoQlATFZY1Oa7Rl+e

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2600	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3400 set thread context of 616	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 2600	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	79
PID 3400 wrote to memory of 2600	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	79
PID 3400 wrote to memory of 2600	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	79
PID 3400 wrote to memory of 616	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	81
PID 3400 wrote to memory of 616	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	81
PID 3400 wrote to memory of 616	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	81
PID 3400 wrote to memory of 616	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	81
PID 3400 wrote to memory of 616	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	81
PID 3400 wrote to memory of 616	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	81
PID 3400 wrote to memory of 616	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	81
PID 3400 wrote to memory of 616	3400	7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe	81

C:\Users\Admin\AppData\Local\Temp\7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe
"C:\Users\Admin\AppData\Local\Temp\7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe"
  2⤵
  - Modifies Windows Firewall
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe
  "C:\Users\Admin\AppData\Local\Temp\7d83d737bae2597faf8f2ea8347e0c730a66a2049ef4bf2d7852488a34eaf17e.exe"
  2⤵
  PID:616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/616-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download