630f52776fc4ec55d26c715f6fb3de5cfc5767e97f3e674a625f3eb539e7b82e

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

630f52776fc4ec55d26c715f6fb3de5cfc5767e97f3e674a625f3eb539e7b82e.exe
Size

101KB
MD5

a238027d7c87f76c5f3be6588b9dd829
SHA1

a4242d9c86a47925329cc2806800ca2ff0f845f3
SHA256

630f52776fc4ec55d26c715f6fb3de5cfc5767e97f3e674a625f3eb539e7b82e
SHA512

fbf1d633867db4fb8917f6580828459bab3c27e52bd02967d8d97d5f5276edd919f2663cedaeddd18748a77d86ca4ae0f6aae7237f9d525b19f354864db2cbb5
SSDEEP

1536:7P4mQ+W4hKwHCtjeWQuhrzb8yUNKAbbzCwHzx5e6ywv77St+iyYzdzRvD3:7Pil4YXBFmxN/fXx5ehwSt+iyYdztD

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	630f52776fc4ec55d26c715f6fb3de5cfc5767e97f3e674a625f3eb539e7b82e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4156	2368	630f52776fc4ec55d26c715f6fb3de5cfc5767e97f3e674a625f3eb539e7b82e.exe	88
PID 2368 wrote to memory of 4156	2368	630f52776fc4ec55d26c715f6fb3de5cfc5767e97f3e674a625f3eb539e7b82e.exe	88
PID 2368 wrote to memory of 4156	2368	630f52776fc4ec55d26c715f6fb3de5cfc5767e97f3e674a625f3eb539e7b82e.exe	88

C:\Users\Admin\AppData\Local\Temp\630f52776fc4ec55d26c715f6fb3de5cfc5767e97f3e674a625f3eb539e7b82e.exe
"C:\Users\Admin\AppData\Local\Temp\630f52776fc4ec55d26c715f6fb3de5cfc5767e97f3e674a625f3eb539e7b82e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ykb..bat" > nul 2> nul
  2⤵
  PID:4156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ykb..bat

Filesize
274B

MD5
46cb2e90dcd05d7373576f024a48aeac

SHA1
497668658f3d8516add1645fc86864661d53d301

SHA256
8892bb779cd9eb95c99c473c9187e39c40d03127659878d7830f3febc6ba751f

SHA512
a231c0eea3af4557e528828a1ac4623a0ec65fa5bc26331dbe3a93746f6695a4a1e4c88e8e9ea20733bd0f86b1007e20540ec98f1d87b66b46d26096ab7e3e04

Download Submit
memory/2368-132-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2368-133-0x0000000000401000-0x0000000000407000-memory.dmp

Filesize
24KB

Download
memory/2368-134-0x00000000001C0000-0x00000000001D9000-memory.dmp

Filesize
100KB

Download
memory/2368-135-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2368-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download