89b166cb256b54a59547e06c8595664c2f5273c5053748a7c3008d37c93a629d

Analysis

max time kernel
98s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89b166cb256b54a59547e06c8595664c2f5273c5053748a7c3008d37c93a629d.exe
Size

187KB
MD5

6e597c5cc2d1f6002fbdfa1c8930687c
SHA1

1b914988d782d81bcec9f0913390bc2cd2bfdd5d
SHA256

89b166cb256b54a59547e06c8595664c2f5273c5053748a7c3008d37c93a629d
SHA512

cd5e138e485d82a31d3dfab6dceac62552bb25b9d6624939404a6910ad63873184d1fc69af79db6425a3ea6bd7766f765740bf33b2e51d3f9ba15429dc97e908
SSDEEP

3072:gbecw8GlS2+646tawgD4zuwhPKUH0wHKtXdmpnZ:/lD+646tazDkZUnM

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	89b166cb256b54a59547e06c8595664c2f5273c5053748a7c3008d37c93a629d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5084	89b166cb256b54a59547e06c8595664c2f5273c5053748a7c3008d37c93a629d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 1824	5084	89b166cb256b54a59547e06c8595664c2f5273c5053748a7c3008d37c93a629d.exe	84
PID 5084 wrote to memory of 1824	5084	89b166cb256b54a59547e06c8595664c2f5273c5053748a7c3008d37c93a629d.exe	84
PID 5084 wrote to memory of 1824	5084	89b166cb256b54a59547e06c8595664c2f5273c5053748a7c3008d37c93a629d.exe	84

C:\Users\Admin\AppData\Local\Temp\89b166cb256b54a59547e06c8595664c2f5273c5053748a7c3008d37c93a629d.exe
"C:\Users\Admin\AppData\Local\Temp\89b166cb256b54a59547e06c8595664c2f5273c5053748a7c3008d37c93a629d.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Eff..bat" > nul 2> nul
  2⤵
  PID:1824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Eff..bat

Filesize
274B

MD5
4d3c1809f64b8e3dab31aa799ce2e3f3

SHA1
7cd0f875b43132a0d7f9e0f295954340da979a9a

SHA256
307f82678dba4331e62b95d96761b04b20ec16b749bdba5fb06f3ae5474306c5

SHA512
8623e020ce74b1fb850a289456a0a41ff073e202d0c51afd0404d2265b685a96cca96252255d6ea7dd917110ae1984a00b02b3fd94ce231db0fdf04a7e2a929e

Download Submit
memory/5084-132-0x0000000002290000-0x00000000022B2000-memory.dmp

Filesize
136KB

Download
memory/5084-133-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5084-135-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download