99bf4fe4a20e63996eb4cdf14a1f7e3a99a8014bc8b9f3d6ba902819bd0df407

Analysis

max time kernel
157s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99bf4fe4a20e63996eb4cdf14a1f7e3a99a8014bc8b9f3d6ba902819bd0df407.exe
Size

156KB
MD5

06d299ac4e7361e21c37adf185bf9670
SHA1

e7048e7419533a221de51cdd10cc8c81d3cafc49
SHA256

99bf4fe4a20e63996eb4cdf14a1f7e3a99a8014bc8b9f3d6ba902819bd0df407
SHA512

fe9aa8c4aca0cf986d71d74f14f8c7d8d83a41c63735b91fe9ff1ebb5d39b7a45b4c683ce56629dc1ecd5136c17c59f4be1a1ec9c472426988aa3d20289a6ffd
SSDEEP

3072:8rfYStS11rNiWzy9E10CZW9AxXFR6gLxeYlm05A7QoE08:Gf3tmxiWzy9E10CZW9ANF0g0YwgAcG

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	99bf4fe4a20e63996eb4cdf14a1f7e3a99a8014bc8b9f3d6ba902819bd0df407.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\99bf4fe4a20e63996eb4cdf14a1f7e3a99a8014bc8b9f3d6ba902819bd0df407.exe
"C:\Users\Admin\AppData\Local\Temp\99bf4fe4a20e63996eb4cdf14a1f7e3a99a8014bc8b9f3d6ba902819bd0df407.exe"
1⤵
- Checks computer location settings
PID:4364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4364-132-0x0000000000F10000-0x0000000000F3C000-memory.dmp

Filesize
176KB

Download
memory/4364-133-0x0000000007E60000-0x0000000007EFC000-memory.dmp

Filesize
624KB

Download
memory/4364-134-0x00000000084B0000-0x0000000008A54000-memory.dmp

Filesize
5.6MB

Download
memory/4364-135-0x0000000007F00000-0x0000000007F92000-memory.dmp

Filesize
584KB

Download
memory/4364-136-0x0000000007E00000-0x0000000007E0A000-memory.dmp

Filesize
40KB

Download
memory/4364-137-0x00000000080F0000-0x0000000008146000-memory.dmp

Filesize
344KB

Download