dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2

Analysis

max time kernel
111s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe
Size

5.1MB
MD5

6fd27220c68e47aa2f7867173bbc7d8e
SHA1

88666798a4e574b2ae52d9399805a7e4c401b092
SHA256

dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2
SHA512

8850c0a9a0df4b3b42058bc139e6c133614c9cd03b569168aeb2048ae2931d44dafbccbea3f29a27c0a281dfd4e79a0b68493836b48a7c9a6297c1b65cb4fc79
SSDEEP

24576:QBi14HEntb6qqW0BtSasydx+/gWD2BND6t3LYXIH1qMQop:QB1HSwKX2zWYYH8op

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1972	search.cmd

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	search.cmd

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1972	2204	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	86
PID 2204 wrote to memory of 1972	2204	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	86
PID 2204 wrote to memory of 1972	2204	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	86
PID 2204 wrote to memory of 208	2204	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	88
PID 2204 wrote to memory of 208	2204	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	88
PID 2204 wrote to memory of 208	2204	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	88

C:\Users\Admin\AppData\Local\Temp\dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe
"C:\Users\Admin\AppData\Local\Temp\dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del c:\users\admin\appdata\local\temp\DD8F23~1.EXE >> NUL
  2⤵
  PID:208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
5.1MB

MD5
6fd27220c68e47aa2f7867173bbc7d8e

SHA1
88666798a4e574b2ae52d9399805a7e4c401b092

SHA256
dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2

SHA512
8850c0a9a0df4b3b42058bc139e6c133614c9cd03b569168aeb2048ae2931d44dafbccbea3f29a27c0a281dfd4e79a0b68493836b48a7c9a6297c1b65cb4fc79

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
5.1MB

MD5
6fd27220c68e47aa2f7867173bbc7d8e

SHA1
88666798a4e574b2ae52d9399805a7e4c401b092

SHA256
dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2

SHA512
8850c0a9a0df4b3b42058bc139e6c133614c9cd03b569168aeb2048ae2931d44dafbccbea3f29a27c0a281dfd4e79a0b68493836b48a7c9a6297c1b65cb4fc79

Download Submit
memory/1972-137-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/1972-139-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/2204-132-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/2204-138-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download