966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007

Analysis

max time kernel
150s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007.exe
Size

470KB
MD5

57d8b563b587aecee18387a016f49710
SHA1

e4963598f46b66a3c9835d892a839cf154fcb04a
SHA256

966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007
SHA512

b4a9213044bbabbf268dc06adfa9a58f2d2c1cd7552aa6746213fee7e7d516d18a288f883b43f1198c6fdfbae7efb59f5c9371a2939406e0e53df3de3f5894fe
SSDEEP

12288:p6Wq4aaE6KwyF5L0Y2D1PqLIzXyXUkr7V6:/thEVaPqLIDoUkrB6

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4780	Microsoft.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3676-132-0x0000000000400000-0x00000000004FA000-memory.dmp	upx
behavioral2/memory/3676-133-0x0000000000400000-0x00000000004FA000-memory.dmp	upx
behavioral2/files/0x0008000000022e17-135.dat	upx
behavioral2/files/0x0008000000022e17-136.dat	upx
behavioral2/memory/3676-139-0x0000000000400000-0x00000000004FA000-memory.dmp	upx
behavioral2/memory/4780-138-0x0000000000400000-0x00000000004FA000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3676-133-0x0000000000400000-0x00000000004FA000-memory.dmp	autoit_exe
behavioral2/memory/3676-139-0x0000000000400000-0x00000000004FA000-memory.dmp	autoit_exe
behavioral2/memory/4780-138-0x0000000000400000-0x00000000004FA000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4780	3676	966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007.exe	81
PID 3676 wrote to memory of 4780	3676	966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007.exe	81
PID 3676 wrote to memory of 4780	3676	966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007.exe	81

C:\Users\Admin\AppData\Local\Temp\966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007.exe
"C:\Users\Admin\AppData\Local\Temp\966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\Microsoft.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft.exe" "del" C:\Users\Admin\AppData\Local\Temp\966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007.exe
  2⤵
  - Executes dropped EXE
  PID:4780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft.exe

Filesize
470KB

MD5
57d8b563b587aecee18387a016f49710

SHA1
e4963598f46b66a3c9835d892a839cf154fcb04a

SHA256
966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007

SHA512
b4a9213044bbabbf268dc06adfa9a58f2d2c1cd7552aa6746213fee7e7d516d18a288f883b43f1198c6fdfbae7efb59f5c9371a2939406e0e53df3de3f5894fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft.exe

Filesize
470KB

MD5
57d8b563b587aecee18387a016f49710

SHA1
e4963598f46b66a3c9835d892a839cf154fcb04a

SHA256
966bdeba31c31c351e181d8deded2f4d213656f6484c7eb7ccd1c31b47b5c007

SHA512
b4a9213044bbabbf268dc06adfa9a58f2d2c1cd7552aa6746213fee7e7d516d18a288f883b43f1198c6fdfbae7efb59f5c9371a2939406e0e53df3de3f5894fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft.exe.ini

Filesize
11B

MD5
301a3e5a5c08c60b2952122a97e1a838

SHA1
c85da2ebd9e1098eed686b8c74016bee728bb942

SHA256
89886e624db56b7f7e7a0a857fc7e63ebfffe9eb69b329489b79dd0a3e24f7fa

SHA512
ce1dcdad347d6c8e6a798b915f8a8d8ac1be4851c0064ab62e80aa85103a472f402b688e94950099a812db1134917fe9d51a7dfa0504e0174e94acdad8ee34d9

Download Submit
memory/3676-132-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/3676-133-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/3676-139-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/4780-138-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download