Analysis

  • max time kernel
    99s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2022, 19:03

General

  • Target

    7abc99d43726a043205ee187e8b2dd12f14ce3cdc8af4931d70333c3b443bcb4.exe

  • Size

    1.5MB

  • MD5

    84a62cb778470889d7080dbb94e853e2

  • SHA1

    122f4e8b09556a59ee7b30375926e64a8b976330

  • SHA256

    7abc99d43726a043205ee187e8b2dd12f14ce3cdc8af4931d70333c3b443bcb4

  • SHA512

    320051d37c7f9fc65c003bbafa85a89d76975cf455750b2c21ea9d6ea4b9b3a372a0f0fad8c334ceef72ab31aaba3ea584a9ec7476e9a91d237d57af92add2f7

  • SSDEEP

    24576:I/XEXjJSFHUKgDuUVAr2hmeUyFLqidqypzSmoROYmWYsdOyqz2AliI5bPoGitGmY:I/oSgDuUVQ2hmeUwqAroRLNkviI5bXD1

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7abc99d43726a043205ee187e8b2dd12f14ce3cdc8af4931d70333c3b443bcb4.exe
    "C:\Users\Admin\AppData\Local\Temp\7abc99d43726a043205ee187e8b2dd12f14ce3cdc8af4931d70333c3b443bcb4.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" -y .\0IKR3.8LH
      2⤵
      • Loads dropped DLL
      PID:4532

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\0IKR3.8LH

    Filesize

    1.6MB

    MD5

    151718565412274c0cf919c3d98887c8

    SHA1

    f90093074a0095ca171ebc27b2cbeee40340c4db

    SHA256

    3f3cd135020bbee7742ee22bc3cbe8796c28e94c08918fefe7a142efacc5a6d7

    SHA512

    25230367df63b21b38a29df4e640d3e8e96dff2452deafa5127c9062927b666d35e6b4bae33d01cc6fc013533ae2cb4b4e50aab7f4e98615d8b33e5f04d827e4

  • C:\Users\Admin\AppData\Local\Temp\0IKR3.8LH

    Filesize

    1.6MB

    MD5

    151718565412274c0cf919c3d98887c8

    SHA1

    f90093074a0095ca171ebc27b2cbeee40340c4db

    SHA256

    3f3cd135020bbee7742ee22bc3cbe8796c28e94c08918fefe7a142efacc5a6d7

    SHA512

    25230367df63b21b38a29df4e640d3e8e96dff2452deafa5127c9062927b666d35e6b4bae33d01cc6fc013533ae2cb4b4e50aab7f4e98615d8b33e5f04d827e4

  • memory/4532-135-0x0000000002F60000-0x000000000308F000-memory.dmp

    Filesize

    1.2MB

  • memory/4532-136-0x0000000003190000-0x0000000003288000-memory.dmp

    Filesize

    992KB

  • memory/4532-137-0x0000000003290000-0x0000000003352000-memory.dmp

    Filesize

    776KB

  • memory/4532-138-0x0000000003360000-0x000000000340D000-memory.dmp

    Filesize

    692KB

  • memory/4532-139-0x0000000003360000-0x000000000340D000-memory.dmp

    Filesize

    692KB

  • memory/4532-141-0x0000000003190000-0x0000000003288000-memory.dmp

    Filesize

    992KB