3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe
Size

187KB
MD5

81dd9ce7f82c735af905ae13de962d49
SHA1

3eb3b4c7766e46dbb5c60f26ffffa26b38216fd6
SHA256

3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7
SHA512

c39366d5be22cac3898c2835f488bb8d1295b3f19faf2d38b05cee0cb006b81039ccaa65e45203be26507ca3a96f08b3e0d69794087fdb77e11a526a63312bbb
SSDEEP

3072:fcTadsWbvOxyEOk/fMgOOxtIyz8AudV3iB3x+y9SNcHScK6F5oCHpXGMQoDazRz6:kT+Lk3fxqyzyil2GyUHdJWMQLm

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4420	.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4420	4760	3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe	82
PID 4760 wrote to memory of 4420	4760	3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe	82
PID 4760 wrote to memory of 4420	4760	3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe	82

C:\Users\Admin\AppData\Local\Temp\3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe
"C:\Users\Admin\AppData\Local\Temp\3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\ .exe
  "C:\Users\Admin\AppData\Local\Temp\ .exe"
  2⤵
  - Executes dropped EXE
  PID:4420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ .exe

Filesize
187KB

MD5
81dd9ce7f82c735af905ae13de962d49

SHA1
3eb3b4c7766e46dbb5c60f26ffffa26b38216fd6

SHA256
3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7

SHA512
c39366d5be22cac3898c2835f488bb8d1295b3f19faf2d38b05cee0cb006b81039ccaa65e45203be26507ca3a96f08b3e0d69794087fdb77e11a526a63312bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ .exe

Filesize
187KB

MD5
81dd9ce7f82c735af905ae13de962d49

SHA1
3eb3b4c7766e46dbb5c60f26ffffa26b38216fd6

SHA256
3ae87f999b66ac3382127fa400a5c4852574498cd24390885051c37e568d4ce7

SHA512
c39366d5be22cac3898c2835f488bb8d1295b3f19faf2d38b05cee0cb006b81039ccaa65e45203be26507ca3a96f08b3e0d69794087fdb77e11a526a63312bbb

Download Submit
memory/4760-132-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download
memory/4760-136-0x0000000075170000-0x0000000075721000-memory.dmp

Filesize
5.7MB

Download