cf64917a1ca8cab9fd75996d73fcd1d0a1623503ed05685aa36e2196a34a2870

Analysis

max time kernel
83s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf64917a1ca8cab9fd75996d73fcd1d0a1623503ed05685aa36e2196a34a2870.exe
Size

88KB
MD5

61fd3bd965b8e7da6f435a1d0b48cb86
SHA1

0c48f84602dec368953f942b9b43b5d51b3202de
SHA256

cf64917a1ca8cab9fd75996d73fcd1d0a1623503ed05685aa36e2196a34a2870
SHA512

31ccb31cc29d4f07b47acaf9327136a207109a3ac2655327d12570715c427eb3d735a814045bde04123e93199f1a757af46c986c8a42d3a1e720d7be8f54a6c2
SSDEEP

1536:KCg3iU2S9XMm2KWDMjFbJsMIDTaeq+gk+6cC5d2tviuPaTlUC4OJoC3v700FI+L:KCg3iU2S9XMm2KWmFtsfW+H+6jdeOJNZ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cf64917a1ca8cab9fd75996d73fcd1d0a1623503ed05685aa36e2196a34a2870.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 4060	2636	cf64917a1ca8cab9fd75996d73fcd1d0a1623503ed05685aa36e2196a34a2870.exe	83
PID 2636 wrote to memory of 4060	2636	cf64917a1ca8cab9fd75996d73fcd1d0a1623503ed05685aa36e2196a34a2870.exe	83
PID 2636 wrote to memory of 4060	2636	cf64917a1ca8cab9fd75996d73fcd1d0a1623503ed05685aa36e2196a34a2870.exe	83

C:\Users\Admin\AppData\Local\Temp\cf64917a1ca8cab9fd75996d73fcd1d0a1623503ed05685aa36e2196a34a2870.exe
"C:\Users\Admin\AppData\Local\Temp\cf64917a1ca8cab9fd75996d73fcd1d0a1623503ed05685aa36e2196a34a2870.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Svf..bat" > nul 2> nul
  2⤵
  PID:4060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Svf..bat

Filesize
274B

MD5
40ed5e01aab20ac8fc2bdbada77ed40a

SHA1
28900bd335c13406723519ef579621ea786f5e56

SHA256
363aeddcd9ff97d43e62cf49d98505460b48c7c34d3ffe11d2b4f04ab9f4d948

SHA512
58a7bf2ba94c218e34162e97f7e2e6280fd0b575f252b0d19affd7a28f3807e5b9c4dbd1e71864456a1ada0fbfa799db2268c74ff72baf0e3eeaacdfb2c46878

Download Submit
memory/2636-132-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2636-134-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download