d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54

Analysis

max time kernel
150s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe
Size

164KB
MD5

18394e4a1e0c8b51e45ef5bf4640f185
SHA1

69e9f38f8fc427b75a7a6a39bddb6d6dbd575ba2
SHA256

d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54
SHA512

f24cb42c84e2bf1263a55e7863efbdb5f3775a484a6fc0a278f7605a37ebc8e4ea8712c08144884f5f3ee41ee117caf7d48c799cdf45594e53772301d6ac5768
SSDEEP

1536:A5HJf9MY1kGhMMdltuvJP5+FrZb2VGC/2JN:A57MY1BiMdnuvn+F2/2T

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4416	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4788	4416	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe	81
PID 4416 wrote to memory of 4788	4416	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe	81
PID 4416 wrote to memory of 4788	4416	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe	81

C:\Users\Admin\AppData\Local\Temp\d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe
"C:\Users\Admin\AppData\Local\Temp\d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Itv..bat" > nul 2> nul
  2⤵
  PID:4788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Itv..bat

Filesize
274B

MD5
4663d034d25a7bea10a58143b4748af5

SHA1
ef9040fc08e472010997368f6b96f44bb4df4772

SHA256
74b6201ca88dacea2a76931d0c3f1e4fef69c2c0d8e0c4fa1a2176cd30d38ddf

SHA512
af26f579c40dcc7c7fc7a937f73e274e056417feafbc0888fc198f6b2cd8b13a2bc91788f3784ce0910716b6789ef96c582aaa87c2dc65cdd1ba87c9a42ba0cc

Download Submit
memory/4416-133-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4416-132-0x00000000022F0000-0x0000000002312000-memory.dmp

Filesize
136KB

Download
memory/4416-135-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download