b83bca24cf8d4e13454098c72b5bda8178c3dd0add4b74769b585018aa892bc6

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b83bca24cf8d4e13454098c72b5bda8178c3dd0add4b74769b585018aa892bc6.exe
Size

9KB
MD5

92b4ca10cb9cb5681478c9b628ff3fdb
SHA1

d9ad494a2b0396e3a9efcf74bf859a3c01ac0267
SHA256

b83bca24cf8d4e13454098c72b5bda8178c3dd0add4b74769b585018aa892bc6
SHA512

99c40dfcb4d36ecc24dd84abf6d16cdd5ac040126cc12ced02a902bedb9b18e75765ff61e60567c4134f37ef6cdc31f9bc61e80b7d626329109939c2d881da96
SSDEEP

96:Zw4MbESNIhWapvzHu8zTnKyG4644C9pqFYjzL2ViDOGD0TAxUozvY7q5qD2/jZNs:S4MbbNIv9OGnK/4GGVjOA08MG5kor3s/

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4932	disqe.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	b83bca24cf8d4e13454098c72b5bda8178c3dd0add4b74769b585018aa892bc6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4932	4960	b83bca24cf8d4e13454098c72b5bda8178c3dd0add4b74769b585018aa892bc6.exe	82
PID 4960 wrote to memory of 4932	4960	b83bca24cf8d4e13454098c72b5bda8178c3dd0add4b74769b585018aa892bc6.exe	82
PID 4960 wrote to memory of 4932	4960	b83bca24cf8d4e13454098c72b5bda8178c3dd0add4b74769b585018aa892bc6.exe	82

C:\Users\Admin\AppData\Local\Temp\b83bca24cf8d4e13454098c72b5bda8178c3dd0add4b74769b585018aa892bc6.exe
"C:\Users\Admin\AppData\Local\Temp\b83bca24cf8d4e13454098c72b5bda8178c3dd0add4b74769b585018aa892bc6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\disqe.exe
  "C:\Users\Admin\AppData\Local\Temp\disqe.exe"
  2⤵
  - Executes dropped EXE
  PID:4932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\disqe.exe

Filesize
9KB

MD5
b979c41c9004764b59ed14df5bb27e5c

SHA1
0daf97aa0f329cd2b43adb312c6e0059be307877

SHA256
d426f82c7217173abc208e833e998c8d87ae78376b035817a8a820adfb0db31d

SHA512
b25724a943dcccdad724a0bd5aaa01e927a3cf96a276efdd01016ae39ddb3b6165f1f20a3e58ded3a7633ec8c41d5c753b2d0e1d24f9cecb36ae4624e0f58e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\disqe.exe

Filesize
9KB

MD5
b979c41c9004764b59ed14df5bb27e5c

SHA1
0daf97aa0f329cd2b43adb312c6e0059be307877

SHA256
d426f82c7217173abc208e833e998c8d87ae78376b035817a8a820adfb0db31d

SHA512
b25724a943dcccdad724a0bd5aaa01e927a3cf96a276efdd01016ae39ddb3b6165f1f20a3e58ded3a7633ec8c41d5c753b2d0e1d24f9cecb36ae4624e0f58e97

Download Submit