44ba01c4e4d873a1b061d217cbc26cefacd1646211e7e4ab6cbda0b9d5065e98

Analysis

max time kernel
133s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44ba01c4e4d873a1b061d217cbc26cefacd1646211e7e4ab6cbda0b9d5065e98.exe
Size

21KB
MD5

820d252c87a14f8187302c0ec7f59430
SHA1

708c76f2eb25ce2ee6cc02047599663448809006
SHA256

44ba01c4e4d873a1b061d217cbc26cefacd1646211e7e4ab6cbda0b9d5065e98
SHA512

cba2ca8123fce53a0855ce218a370fa5bdfa2261b648333b24e320a1234092109934b64a3801d2a30ce6287023d483024631a36ee0aedc94f4aba23dc815f2a4
SSDEEP

384:uu/JYSrFQjGxzfNHP151QUzMk9hBcecy44hLytstItVYt7tqFtnNtD/:d/3xd1HXzoy44hxq4ZYFPR

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4336	update_pdf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	44ba01c4e4d873a1b061d217cbc26cefacd1646211e7e4ab6cbda0b9d5065e98.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4336	4760	44ba01c4e4d873a1b061d217cbc26cefacd1646211e7e4ab6cbda0b9d5065e98.exe	84
PID 4760 wrote to memory of 4336	4760	44ba01c4e4d873a1b061d217cbc26cefacd1646211e7e4ab6cbda0b9d5065e98.exe	84
PID 4760 wrote to memory of 4336	4760	44ba01c4e4d873a1b061d217cbc26cefacd1646211e7e4ab6cbda0b9d5065e98.exe	84

C:\Users\Admin\AppData\Local\Temp\44ba01c4e4d873a1b061d217cbc26cefacd1646211e7e4ab6cbda0b9d5065e98.exe
"C:\Users\Admin\AppData\Local\Temp\44ba01c4e4d873a1b061d217cbc26cefacd1646211e7e4ab6cbda0b9d5065e98.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\update_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\update_pdf.exe"
  2⤵
  - Executes dropped EXE
  PID:4336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\update_pdf.exe

Filesize
22KB

MD5
18bdaf381e6bc62214bff6c8c1413bc9

SHA1
7ca464b3fb81d7828fd21fc5f2c6fe10db898d49

SHA256
4c30f6447c738cea25a59069966523f9e64a5b3f8b3cd64903911b1beaa8b94d

SHA512
47d81fda7db8aa0554b6db3228a2804e99b423efb34cada2053058e244e84c57fbb3d79b719bfe12514b4dc88aae687afbe3979c5ade586c4f167fbc240a7283

Download Submit
C:\Users\Admin\AppData\Local\Temp\update_pdf.exe

Filesize
22KB

MD5
18bdaf381e6bc62214bff6c8c1413bc9

SHA1
7ca464b3fb81d7828fd21fc5f2c6fe10db898d49

SHA256
4c30f6447c738cea25a59069966523f9e64a5b3f8b3cd64903911b1beaa8b94d

SHA512
47d81fda7db8aa0554b6db3228a2804e99b423efb34cada2053058e244e84c57fbb3d79b719bfe12514b4dc88aae687afbe3979c5ade586c4f167fbc240a7283

Download Submit