6afaa0669c83f877de786ba2e8f80556498458a9f65c79f0645644426eff3449

Analysis

max time kernel
159s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6afaa0669c83f877de786ba2e8f80556498458a9f65c79f0645644426eff3449.exe
Size 196KB
Sample221019-t78c5agecl
SHA256 6afaa0669c83f877de786ba2e8f80556498458a9f65c79f0645644426eff3449
MD5 a0b41fe9122e25ce489d16bd93a58850
SHA1 7adb850f9d258fd0161e991fdf3396047250bb95
SHA512 6297ee58455261064409dd78be3a0d0fbfc7a5e99cb08cb74713dd4397cf9bbcc6517981ee4d749cd1f0991c489f7b32868ff31b58386c37ed51da4ccc42da8b
SSDEEP 3072:aM65zTN7RH9AvfrF3fpp0dL5qxpubZyejITv9fXFg1:1mTNJ0frF3Bp0dLiobP+v9fVa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	6afaa0669c83f877de786ba2e8f80556498458a9f65c79f0645644426eff3449.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1132	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 4216	392	6afaa0669c83f877de786ba2e8f80556498458a9f65c79f0645644426eff3449.exe	80
PID 392 wrote to memory of 4216	392	6afaa0669c83f877de786ba2e8f80556498458a9f65c79f0645644426eff3449.exe	80
PID 392 wrote to memory of 4216	392	6afaa0669c83f877de786ba2e8f80556498458a9f65c79f0645644426eff3449.exe	80
PID 4216 wrote to memory of 1132	4216	cmd.exe	82
PID 4216 wrote to memory of 1132	4216	cmd.exe	82
PID 4216 wrote to memory of 1132	4216	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\6afaa0669c83f877de786ba2e8f80556498458a9f65c79f0645644426eff3449.exe
"C:\Users\Admin\AppData\Local\Temp\6afaa0669c83f877de786ba2e8f80556498458a9f65c79f0645644426eff3449.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\980A.tmp.bat" >> NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2 -w 1000
    3⤵
    - Runs ping.exe
    PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

980A.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\980A.tmp.bat
Size 130B
SHA256 4a838dda60bf6ac9942c98d5bb3fc05ad1a40d11b1789400c47770b627b0ad6e
MD5 29113963b47afd29a40aba3a4ee6bb49
SHA1 a521579e7a14202703e327c2624723b5ce34baa5
SHA512 600de53440367f4c7693d1c9a28ff100598192652f3c14a64e214bb9e6bf7261318a6d35cf7dc450fc1fb6a98909131557dce6d0f2aabf98a0cb7e373c361f4e
MD5 SHA1 SHA512

Submit Download