c47608516ec7a3399a3de614d7f400cd186d040865b80882866a09da9dcf8cff

Analysis

max time kernel
92s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c47608516ec7a3399a3de614d7f400cd186d040865b80882866a09da9dcf8cff.exe
Size

26KB
MD5

7c96b99d436dfc0dce82a22448305f40
SHA1

c17a438c842d8fca35c046ff0b77004e31f2303d
SHA256

c47608516ec7a3399a3de614d7f400cd186d040865b80882866a09da9dcf8cff
SHA512

6bae6f08c381c1c590188a9a56debc1eca48be5a82106ad1dc687b11852072795a4766e33d8a4567269ec7033d2a1ab86b2b31c4a3496d3354c9fcd884014a20
SSDEEP

384:b3JjmrXrSNbEO6oDPlDCQ3ghVSSUrURRHzdWZ+dshe9tehDMI4Wk:bQIDkSSUrURxYZ+teY

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	c47608516ec7a3399a3de614d7f400cd186d040865b80882866a09da9dcf8cff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\c47608516ec7a3399a3de614d7f400cd186d040865b80882866a09da9dcf8cff.exe
"C:\Users\Admin\AppData\Local\Temp\c47608516ec7a3399a3de614d7f400cd186d040865b80882866a09da9dcf8cff.exe"
1⤵
- Checks computer location settings
PID:5080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5080-132-0x00007FFB8CC70000-0x00007FFB8D6A6000-memory.dmp

Filesize
10.2MB

Download