2f499bdf1da77bc4cc303d4b61f21b1358918534d94f08976d6e42d58ad45731

Analysis

max time kernel
134s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2022 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f499bdf1da77bc4cc303d4b61f21b1358918534d94f08976d6e42d58ad45731.exe
Size

128KB
MD5

58d9456abf82f1220e3054ebe9490936
SHA1

905951e8d014248612559470c6fb640ea30a3c16
SHA256

2f499bdf1da77bc4cc303d4b61f21b1358918534d94f08976d6e42d58ad45731
SHA512

e0c033b484dac48d0bd238c8ddb1f691baa672ad26857363dd581d9b9a49bcd3ac6d00e5c12ebc479446a5c5d20d881594a876d3aaa0ed9c0a963a086d29f995
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbxGYQbxGYQbEceB:V6a+pOtEvwDpjt22E

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2116	asih.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	2f499bdf1da77bc4cc303d4b61f21b1358918534d94f08976d6e42d58ad45731.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2116	4968	2f499bdf1da77bc4cc303d4b61f21b1358918534d94f08976d6e42d58ad45731.exe	82
PID 4968 wrote to memory of 2116	4968	2f499bdf1da77bc4cc303d4b61f21b1358918534d94f08976d6e42d58ad45731.exe	82
PID 4968 wrote to memory of 2116	4968	2f499bdf1da77bc4cc303d4b61f21b1358918534d94f08976d6e42d58ad45731.exe	82

C:\Users\Admin\AppData\Local\Temp\2f499bdf1da77bc4cc303d4b61f21b1358918534d94f08976d6e42d58ad45731.exe
"C:\Users\Admin\AppData\Local\Temp\2f499bdf1da77bc4cc303d4b61f21b1358918534d94f08976d6e42d58ad45731.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
128KB

MD5
373492ccf5ce9aa1d491c8efae1036ee

SHA1
aae8b15ee3c67ceb1290de2dc8f55fbdff791146

SHA256
2aa4325026f8a6a9138c8528220c8eaf2433679d65fb2669a5edf82ea4ade9a7

SHA512
134f5640e90394984e0709f7d0af7446fcb59692f3bffef9d3668bb04b1c63ffe7bb395c062a7c73e051a9ae0ce6bf74843085ca45bbf90f3e877000692cf256

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
128KB

MD5
373492ccf5ce9aa1d491c8efae1036ee

SHA1
aae8b15ee3c67ceb1290de2dc8f55fbdff791146

SHA256
2aa4325026f8a6a9138c8528220c8eaf2433679d65fb2669a5edf82ea4ade9a7

SHA512
134f5640e90394984e0709f7d0af7446fcb59692f3bffef9d3668bb04b1c63ffe7bb395c062a7c73e051a9ae0ce6bf74843085ca45bbf90f3e877000692cf256

Download Submit
memory/2116-144-0x00000000007C0000-0x00000000007C6000-memory.dmp

Filesize
24KB

Download
memory/2116-150-0x0000000000690000-0x0000000000696000-memory.dmp

Filesize
24KB

Download
memory/4968-132-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4968-133-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/4968-139-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download