6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2022 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe
Size

1.3MB
MD5

dd504cd0acd110b833d73bfeec828961
SHA1

134c7466ba53d3280ac4bd7706a099b83ac00dc1
SHA256

6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114
SHA512

04729400cf20ea63b56384c96fa440a23b4c1e293124668e5d6eee79eb58fd04659cf069850ae0b6ef6a95153c96d50d6a7c0f86cd4be3fcf71fad5ec708a30c
SSDEEP

24576:4/D3+gzN7/qEby9WNoIvPa/WaM8I+tYA8rPBSMK08hxs:4qgzN7/1yahgzMK8rpSMK08hO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3508	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3508	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe
3508	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3508	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3508	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe
3508	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3508	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe
3508	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
540	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe
3508	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3508	540	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe	79
PID 540 wrote to memory of 3508	540	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe	79
PID 540 wrote to memory of 3508	540	6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe	79

C:\Users\Admin\AppData\Local\Temp\6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe
"C:\Users\Admin\AppData\Local\Temp\6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe
  "C:\Users\Admin\AppData\Local\Temp\6c6fae5589d1599528f63338645c7576ea974ed61d3f67f02dc9c241dc60c114.exe" - 789CE3E6C60EDA17399CFFFDE4A9030E696E00CF73074D
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-132-0x0000000000400000-0x00000000006E6000-memory.dmp

Filesize
2.9MB

Download
memory/540-134-0x0000000002C20000-0x0000000002CD8000-memory.dmp

Filesize
736KB

Download
memory/540-141-0x0000000002EC0000-0x0000000002F2D000-memory.dmp

Filesize
436KB

Download
memory/540-149-0x0000000000400000-0x00000000006E6000-memory.dmp

Filesize
2.9MB

Download
memory/3508-148-0x0000000000000000-mapping.dmp

Download
memory/3508-151-0x00000000029A0000-0x0000000002A58000-memory.dmp

Filesize
736KB

Download
memory/3508-158-0x0000000002C30000-0x0000000002C9D000-memory.dmp

Filesize
436KB

Download
memory/3508-165-0x0000000000400000-0x00000000006E6000-memory.dmp

Filesize
2.9MB

Download
memory/3508-166-0x0000000000400000-0x00000000006E6000-memory.dmp

Filesize
2.9MB

Download