d5ad99e52dcdcd51014811cb97ebf68152ab7dc0022c858d2743703f405990f6

Analysis

max time kernel
92s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5ad99e52dcdcd51014811cb97ebf68152ab7dc0022c858d2743703f405990f6.exe
Size

189KB
MD5

968f0c30ee4efc33ffad8067d92b82cb
SHA1

50442bb6dfa15eefb745556ed6a3761f79a71e18
SHA256

d5ad99e52dcdcd51014811cb97ebf68152ab7dc0022c858d2743703f405990f6
SHA512

3dbccce8dceb28d4b4d31ba3e5b339c1f4adc8cffa68da23b6bd153993b92a97db20ea025a762f7038e41e123dc3f5a901d717df4f096ad191a6292998601786
SSDEEP

3072:gxwnmp+2vp7NR4w0SAitBjrq3MjKTGBrub+69olekjG:g2U+KZIw0Ee0KUrub+69olek

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	d5ad99e52dcdcd51014811cb97ebf68152ab7dc0022c858d2743703f405990f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4628	4976	d5ad99e52dcdcd51014811cb97ebf68152ab7dc0022c858d2743703f405990f6.exe	81
PID 4976 wrote to memory of 4628	4976	d5ad99e52dcdcd51014811cb97ebf68152ab7dc0022c858d2743703f405990f6.exe	81
PID 4976 wrote to memory of 4628	4976	d5ad99e52dcdcd51014811cb97ebf68152ab7dc0022c858d2743703f405990f6.exe	81

C:\Users\Admin\AppData\Local\Temp\d5ad99e52dcdcd51014811cb97ebf68152ab7dc0022c858d2743703f405990f6.exe
"C:\Users\Admin\AppData\Local\Temp\d5ad99e52dcdcd51014811cb97ebf68152ab7dc0022c858d2743703f405990f6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Obb..bat" > nul 2> nul
  2⤵
  PID:4628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Obb..bat

Filesize
274B

MD5
33a1fc42c53ef59c997d53b9ff612e8f

SHA1
84fa353cdabdebd747aa7742b4a9fa5b119f7f68

SHA256
d5d65e6e745d0f8761960fdb206b0ccce6024302b2452065025ef7db37f62c4d

SHA512
55d76eae723f43fccc8ed93e36d5b5446e780fffb3421bda9c66c662a4988157d070ba5d0bf265bf59b720792bf23ac6da29739cc5e9aacfe7a65b836bb3fdbe

Download Submit
memory/4976-132-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4976-133-0x0000000002220000-0x000000000224D000-memory.dmp

Filesize
180KB

Download
memory/4976-134-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4976-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4976-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download