920f0b2d159a39f480d848786547b1372aefac5693cab9b3d378edbdb730d5aa

Analysis

max time kernel
215s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

920f0b2d159a39f480d848786547b1372aefac5693cab9b3d378edbdb730d5aa.exe
Size

160KB
MD5

631c575bc27ce59dbb4538bb91107ee3
SHA1

015c08d6ec52fb1b8cf15ba5ca8eaeadffc75455
SHA256

920f0b2d159a39f480d848786547b1372aefac5693cab9b3d378edbdb730d5aa
SHA512

d3996dd535c0b0f43052e0432bb383fe00709df73d1adbc321de3b915aaa38f3128cc4de7910155fc3b4e73ca428f8321926d7edd9cf8b631d746bc1766eed74
SSDEEP

3072:8sDV6Az1wWgFvYGnJd6KpZV3uTN9WU/G9h3Gw590KqkbmzALbvl6:tQAbgFvYGJd6KpZV3uTN9WU/G9h2w59X

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	920f0b2d159a39f480d848786547b1372aefac5693cab9b3d378edbdb730d5aa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\920f0b2d159a39f480d848786547b1372aefac5693cab9b3d378edbdb730d5aa.exe
"C:\Users\Admin\AppData\Local\Temp\920f0b2d159a39f480d848786547b1372aefac5693cab9b3d378edbdb730d5aa.exe"
1⤵
- Checks computer location settings
PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-132-0x00007FFFDC8F0000-0x00007FFFDD326000-memory.dmp

Filesize
10.2MB

Download