fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3.exe
Size

73KB
MD5

3297bf438ec0d26ae6b3e63427a7e5c3
SHA1

76b255aba8a9ee6b4b6a95a779fa7d3c9b81be5c
SHA256

fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3
SHA512

25e298b49a90bc4d32993ae189724e05af83cdb068bb4ac2d8630ecea8427432b43bf94fe9b0bb218edf755385f1e699499750d059d69e5f71a15b3a3d8c0390
SSDEEP

1536:4LbwC+enZ4A/5ldZ9EdXFqRcGWUmRxd01Ml6tq7UL/mq/:QTnZ4wAXAvjmHd0gstp

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1812	5044	fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3.exe	82
PID 5044 wrote to memory of 1812	5044	fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3.exe	82
PID 5044 wrote to memory of 1812	5044	fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3.exe	82

C:\Users\Admin\AppData\Local\Temp\fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3.exe
"C:\Users\Admin\AppData\Local\Temp\fb7529d40faf26d2aeb96143920b6849c82c5f2a3978ceb92d57115b6779ccc3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Nwf..bat" > nul 2> nul
  2⤵
  PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Nwf..bat

Filesize
274B

MD5
4e82a169c02e9c844c2aa2999d65033f

SHA1
1bc5a88f48fe6e99dea95ec970c851493c8d4dfa

SHA256
15bc83536c31e3f08fcc34304e64de91db1124c22e229a71191cd4b4b49fe6a2

SHA512
f2f4deacd69a0de2d0f3f6412bb98cefaa26ed35411bbcd1a6a0b6acd090832c0a51d8dd08b6d6defb0724650e60248a993007fd2d2da725b2e2c51bf3e4b7d1

Download Submit
memory/5044-132-0x0000000002170000-0x000000000219D000-memory.dmp

Filesize
180KB

Download
memory/5044-133-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5044-134-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5044-136-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download