598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985

Analysis

max time kernel
144s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe
Size

79KB
MD5

3222a71f4f35ba26252fc3bed10086a4
SHA1

83d874071e69c8d03987dcef0382544668e04f20
SHA256

598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985
SHA512

378696efa119ffd1312ebb655ae43a04fee6a4eaac9f3ecf134820620937dcf67a3a33c342ca914d50f0e244deb181a2d270fce9edc4a72f9112b9f21f3496a5
SSDEEP

1536:VKoYJ/VnGgXqkwk885iXMmX5zGpY8A24xk6p:woyVGZD8IMm6J4xk

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 4348	2336	598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe	83
PID 2336 wrote to memory of 4348	2336	598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe	83
PID 2336 wrote to memory of 4348	2336	598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe	83

C:\Users\Admin\AppData\Local\Temp\598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe
"C:\Users\Admin\AppData\Local\Temp\598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe"
1⤵
- Checks computer location settings
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Hnf..bat" > nul 2> nul
  2⤵
  PID:4348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Hnf..bat

Filesize
274B

MD5
0f8fa21303e737612cfbb06f8a71057c

SHA1
c6064d660391b3ad5a222343314f83666f655f3d

SHA256
ab0fa668388751644b9fc322e9ad0531cabfeaf82fad198eb845cab5f16c2f56

SHA512
79c98345c7b98c4cb4d2421e450b166f5c691cfd5bac89ee2c473736ac026f5b2e06e108f24fc8cf01d2a02869a9c919e41fcc9b13fd83b26e3df47a863a80f9

Download Submit
memory/2336-132-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2336-133-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2336-135-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads