1a1ee0cb123de2f7837dc8c40925915e073308580eee1801246275413faf23ad

Analysis

max time kernel
117s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a1ee0cb123de2f7837dc8c40925915e073308580eee1801246275413faf23ad.exe
Size

30KB
MD5

4aa700997c74c883205264f8486f39b0
SHA1

ab705bebb151a6df5824cbfcd7d9eb480e3e124d
SHA256

1a1ee0cb123de2f7837dc8c40925915e073308580eee1801246275413faf23ad
SHA512

610099a2fb90d039576caf9f57c7da35066864f7025799952fc44ae4b2657d76ce4c627550c225260f2ce8660fd517c07f82885c8bde650dabd9f5f60e47abd5
SSDEEP

384:pAcTAjVwMatOwS58YwWdFeaeohweCvklV4Viq1cKqkI:pZTAa/OZj74FrI

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4720	budha.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1a1ee0cb123de2f7837dc8c40925915e073308580eee1801246275413faf23ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4720	4132	1a1ee0cb123de2f7837dc8c40925915e073308580eee1801246275413faf23ad.exe	82
PID 4132 wrote to memory of 4720	4132	1a1ee0cb123de2f7837dc8c40925915e073308580eee1801246275413faf23ad.exe	82
PID 4132 wrote to memory of 4720	4132	1a1ee0cb123de2f7837dc8c40925915e073308580eee1801246275413faf23ad.exe	82

C:\Users\Admin\AppData\Local\Temp\1a1ee0cb123de2f7837dc8c40925915e073308580eee1801246275413faf23ad.exe
"C:\Users\Admin\AppData\Local\Temp\1a1ee0cb123de2f7837dc8c40925915e073308580eee1801246275413faf23ad.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:4720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
30KB

MD5
c113b8866cfa599d9b271a6942fd5770

SHA1
ec8193677922a425e49c29743c125566cafb4728

SHA256
48ca98ff3941c47afc0440c83e7ceed9bd0b16191296c1e676a73a7570d49002

SHA512
cbe5fc0316ccc485bdd2d556efed0d7663e5614cceba29f1248fe208c1a4cd99a2644fd74d8bf8adda8f9f69b44d4babd7a66e6e9c96d2efe3f8734dce996f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
30KB

MD5
c113b8866cfa599d9b271a6942fd5770

SHA1
ec8193677922a425e49c29743c125566cafb4728

SHA256
48ca98ff3941c47afc0440c83e7ceed9bd0b16191296c1e676a73a7570d49002

SHA512
cbe5fc0316ccc485bdd2d556efed0d7663e5614cceba29f1248fe208c1a4cd99a2644fd74d8bf8adda8f9f69b44d4babd7a66e6e9c96d2efe3f8734dce996f48

Download Submit
memory/4132-132-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4132-133-0x0000000002150000-0x0000000002157000-memory.dmp

Filesize
28KB

Download
memory/4720-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4720-138-0x0000000000560000-0x0000000000567000-memory.dmp

Filesize
28KB

Download