764a7b946e5683aeafddb296fee3fd8ce4d6258befd9170a225689891bfd9d3c

Analysis

max time kernel
163s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

764a7b946e5683aeafddb296fee3fd8ce4d6258befd9170a225689891bfd9d3c.exe
Size

30KB
MD5

73bfbfef456b5ad64a88b24421d2c2e0
SHA1

670fa45e86411079f59ca9c2d0fdb27b1ca65a2e
SHA256

764a7b946e5683aeafddb296fee3fd8ce4d6258befd9170a225689891bfd9d3c
SHA512

0371eec7233d80702d110f39e7e2e36dcf808d6fa672b5fb657743fc4dbfafeea8da75753f253a82e69c80b4b6bc87fa9fdec67c256824a558015ebbfefd7c89
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVajSKg:X6QFElP6n+gJQMOtEvwDpjBcSKg

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5044	asih.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	764a7b946e5683aeafddb296fee3fd8ce4d6258befd9170a225689891bfd9d3c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 5044	3108	764a7b946e5683aeafddb296fee3fd8ce4d6258befd9170a225689891bfd9d3c.exe	82
PID 3108 wrote to memory of 5044	3108	764a7b946e5683aeafddb296fee3fd8ce4d6258befd9170a225689891bfd9d3c.exe	82
PID 3108 wrote to memory of 5044	3108	764a7b946e5683aeafddb296fee3fd8ce4d6258befd9170a225689891bfd9d3c.exe	82

C:\Users\Admin\AppData\Local\Temp\764a7b946e5683aeafddb296fee3fd8ce4d6258befd9170a225689891bfd9d3c.exe
"C:\Users\Admin\AppData\Local\Temp\764a7b946e5683aeafddb296fee3fd8ce4d6258befd9170a225689891bfd9d3c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:5044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
31KB

MD5
61f42dc8b1c4d8d4897a64e5c1b246de

SHA1
3e5b2da3eb0613b30dab7bdfe83a3cfad2fe2f39

SHA256
bf7179e3ae326d1ff37aae2374dfb194656568bb0ca009a383f3c159c5c4f92e

SHA512
e3d07c28b80c169a64c7ef264c3e06dba71e5553e29bfcc2c11e3b53865389d01f9ece6d159ea93f09348c424c0cdb9b7b28ee724ab163bfff3cbd66ee54f797

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
31KB

MD5
61f42dc8b1c4d8d4897a64e5c1b246de

SHA1
3e5b2da3eb0613b30dab7bdfe83a3cfad2fe2f39

SHA256
bf7179e3ae326d1ff37aae2374dfb194656568bb0ca009a383f3c159c5c4f92e

SHA512
e3d07c28b80c169a64c7ef264c3e06dba71e5553e29bfcc2c11e3b53865389d01f9ece6d159ea93f09348c424c0cdb9b7b28ee724ab163bfff3cbd66ee54f797

Download Submit
memory/3108-132-0x0000000000860000-0x0000000000866000-memory.dmp

Filesize
24KB

Download
memory/3108-133-0x0000000000880000-0x0000000000886000-memory.dmp

Filesize
24KB

Download
memory/3108-142-0x0000000000860000-0x0000000000866000-memory.dmp

Filesize
24KB

Download
memory/5044-144-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/5044-150-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download