687c917468b6b40592d1f293dcde689e3e204b8c58ec9ad7370c5b8f2356a99d

Analysis

max time kernel
124s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687c917468b6b40592d1f293dcde689e3e204b8c58ec9ad7370c5b8f2356a99d.exe
Size

96KB
MD5

79e31a5353ed94e99e287346ad003477
SHA1

038eac2fb4ba90da5169effeee8ec30bc0e98703
SHA256

687c917468b6b40592d1f293dcde689e3e204b8c58ec9ad7370c5b8f2356a99d
SHA512

e9de8eba13311108aa1d7bd7f45e8640836b6ecba4057ee36bb738c2b15ec6aaf2bddb6f2b59c0f8abcfa6e8208beea7b3d0111e028ee63c7e9c6c868720e53f
SSDEEP

1536:wRSnTZfr0od8rUhy3edOjL/iJBR4MfpheJVxvcHOG7FIy:rD0oZhy1CJBR4MfXeJVxvcHOG7FIy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	687c917468b6b40592d1f293dcde689e3e204b8c58ec9ad7370c5b8f2356a99d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 3240	2508	687c917468b6b40592d1f293dcde689e3e204b8c58ec9ad7370c5b8f2356a99d.exe	84
PID 2508 wrote to memory of 3240	2508	687c917468b6b40592d1f293dcde689e3e204b8c58ec9ad7370c5b8f2356a99d.exe	84
PID 2508 wrote to memory of 3240	2508	687c917468b6b40592d1f293dcde689e3e204b8c58ec9ad7370c5b8f2356a99d.exe	84

C:\Users\Admin\AppData\Local\Temp\687c917468b6b40592d1f293dcde689e3e204b8c58ec9ad7370c5b8f2356a99d.exe
"C:\Users\Admin\AppData\Local\Temp\687c917468b6b40592d1f293dcde689e3e204b8c58ec9ad7370c5b8f2356a99d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Fpp..bat" > nul 2> nul
  2⤵
  PID:3240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Fpp..bat

Filesize
274B

MD5
e311176202ac48bbb4fef03381724186

SHA1
1166026b56b851eed38fa57540f37e3412741e69

SHA256
aecd4dea7101fea3fc90a5f3821b5cc620b9fd13e15ca6f1b98462655ddd309a

SHA512
ce2f00e2ec8997d794be250ea2676f2fd50b76b38dc4d538163b1d088bf3a835365473210abc51434101ebcff276ebf83aa84520a46ed877dd468372eb1adc1e

Download Submit
memory/2508-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2508-134-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download