f239d96585d337dd33df83852593293acb93c8e6b9c390af7278927fb0673ccd

Analysis

max time kernel
137s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f239d96585d337dd33df83852593293acb93c8e6b9c390af7278927fb0673ccd.exe
Size

219KB
MD5

6c12cfbc72340ca158e38fe8ed4a2537
SHA1

fde2703015d0c1c84e7d18a06774cdb44afd1b69
SHA256

f239d96585d337dd33df83852593293acb93c8e6b9c390af7278927fb0673ccd
SHA512

4a8605952b690f1a3df4d649ea3188e3251e1a874e7a74df260c3beb6e054521214c646a7c7fcca34623a8092e7863ac84bf1da2b6c5dd56a1361d44ac6c3e48
SSDEEP

3072:MI8MLq3gDmyPp2lkygCkkgxMVDJ1nQtwxqye44co:MI8MLDDD7y1knxMcyH4c

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	f239d96585d337dd33df83852593293acb93c8e6b9c390af7278927fb0673ccd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 860	4184	f239d96585d337dd33df83852593293acb93c8e6b9c390af7278927fb0673ccd.exe	80
PID 4184 wrote to memory of 860	4184	f239d96585d337dd33df83852593293acb93c8e6b9c390af7278927fb0673ccd.exe	80
PID 4184 wrote to memory of 860	4184	f239d96585d337dd33df83852593293acb93c8e6b9c390af7278927fb0673ccd.exe	80

C:\Users\Admin\AppData\Local\Temp\f239d96585d337dd33df83852593293acb93c8e6b9c390af7278927fb0673ccd.exe
"C:\Users\Admin\AppData\Local\Temp\f239d96585d337dd33df83852593293acb93c8e6b9c390af7278927fb0673ccd.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Kvf..bat" > nul 2> nul
  2⤵
  PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Kvf..bat

Filesize
274B

MD5
eb799863a8e3d482cc28aadf7574a9d2

SHA1
9c4d020571dd8deef17e16607e33eb4cfd1bf760

SHA256
98f7f3d4ce2188ca68e8f91e0117e2d725fdce0047ed254520a1f4b0c24607b5

SHA512
0d7c422b81a8963c03677be8566bd7206ff5e6199a01d76d1b3b077f7f8064e8d7b4a966d48212f3f816e52ae726bba6fa7044789d9eb8bac900aa253a52ca71

Download Submit
memory/4184-132-0x0000000000A20000-0x0000000000A3E000-memory.dmp

Filesize
120KB

Download
memory/4184-133-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4184-135-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download