821b2b544d28b51d65fc2fe2dbf3343d5b486feafe0586bbbda40681f8a22d15

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

821b2b544d28b51d65fc2fe2dbf3343d5b486feafe0586bbbda40681f8a22d15.exe
Size

162KB
MD5

31e817e8c817b528fb2b1da33aff8687
SHA1

4821dbda2f5a913ccffd8e3efd1cd7523f85d9f5
SHA256

821b2b544d28b51d65fc2fe2dbf3343d5b486feafe0586bbbda40681f8a22d15
SHA512

d1660f085af1cb88d1a87017fc350419bb768519de1307e3f64f901cce52fd11fd3c9b739b760ecc1ff33535cc8d0405a16827a4e01f49f988b141482974561b
SSDEEP

3072:O/7UTpCV3eN1mEbdnkdfYTz8oDp3DAcU:O/7GNbmEByYTz/hDA

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	821b2b544d28b51d65fc2fe2dbf3343d5b486feafe0586bbbda40681f8a22d15.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1324	821b2b544d28b51d65fc2fe2dbf3343d5b486feafe0586bbbda40681f8a22d15.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 5024	1324	821b2b544d28b51d65fc2fe2dbf3343d5b486feafe0586bbbda40681f8a22d15.exe	82
PID 1324 wrote to memory of 5024	1324	821b2b544d28b51d65fc2fe2dbf3343d5b486feafe0586bbbda40681f8a22d15.exe	82
PID 1324 wrote to memory of 5024	1324	821b2b544d28b51d65fc2fe2dbf3343d5b486feafe0586bbbda40681f8a22d15.exe	82

C:\Users\Admin\AppData\Local\Temp\821b2b544d28b51d65fc2fe2dbf3343d5b486feafe0586bbbda40681f8a22d15.exe
"C:\Users\Admin\AppData\Local\Temp\821b2b544d28b51d65fc2fe2dbf3343d5b486feafe0586bbbda40681f8a22d15.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ijp..bat" > nul 2> nul
  2⤵
  PID:5024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ijp..bat

Filesize
274B

MD5
d5bf7e5a511b437b623a9effecc05a46

SHA1
c5dcfe013c92642f66a3739e37b3b21f77a73891

SHA256
ebecca23b3cefa2bcafa0d9df4fe0c512d835fc9d220ea2315a7f927f465c154

SHA512
0543094eb66e369e66d21707ae00cd6e743b8bfa87a3e4b5059da5dcaf9363037d79075bf680b1917b120c12bf7d83e2961407171605f25d8d513fbda8af8834

Download Submit
memory/1324-133-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1324-132-0x0000000002240000-0x0000000002254000-memory.dmp

Filesize
80KB

Download
memory/1324-135-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download