68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9

Analysis

max time kernel
149s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe
Size

111KB
MD5

412fbcfe1c6df5c73e3c4480f71ec3b6
SHA1

d2d5c85814f7355685200e63415f38600f4c5882
SHA256

68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9
SHA512

9d2b057b9b939c964870f02ebfbac7d06fe8c0fa5af781b71e18ae6d2d51f6b461fdf8ee4b803ee4a8289313ba244913fc15d7146a0f67830b62950f6d3ba66e
SSDEEP

3072:Yvz05zKu6jOKuNKEuWKDhm5mlXwWRfemB3GikaVrrQ1IPnHFIb:zyhm5m9RoiXVr01IP0

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 1104	3592	68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe	81
PID 3592 wrote to memory of 1104	3592	68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe	81
PID 3592 wrote to memory of 1104	3592	68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe	81

C:\Users\Admin\AppData\Local\Temp\68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe
"C:\Users\Admin\AppData\Local\Temp\68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Xlf..bat" > nul 2> nul
  2⤵
  PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Xlf..bat

Filesize
274B

MD5
139609a78f35802ee2228a8c58231833

SHA1
05351f014de3d28bd74c16efd5eb3cc9ba1a5e41

SHA256
6d6dc176a5226e7f54004fb551a7df2ef9ef31e1bc543a451692f9bd450389b9

SHA512
124d98e57a9a463e0d5ea16dafeaf1a6ee9ef20e0f4b8a13630211d86518bbbf615d57454700175c3fd34fff6176efe02d35ef791d3c7f4e19bd1eb021127f2e

Download Submit
memory/3592-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3592-133-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3592-135-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download