c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f

Analysis

max time kernel
60s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2022 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe
Size

302KB
MD5

e847fb3f4528d7c82cadbdbf7897d40d
SHA1

73d6bb3b5e110b05a25212cf2b2f80f7f7509763
SHA256

c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f
SHA512

5b1e17626fee819ce89e4604b3e6ee65f9e34cf5cc4bb0a8300d5a87af17bba4c1cf671e62eebab6ca17a554c6883cd8077aa72b4a19fed37d117541941972d0
SSDEEP

6144:9dTeqdWpOXZUFVZpcozdbr9sNcQGLoGIqsSzY6uYPqp:9d/UPdbr9sNcQGjIZS8r3p

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1332	3540	c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe	83
PID 3540 wrote to memory of 1332	3540	c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe	83
PID 3540 wrote to memory of 1332	3540	c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe	83

C:\Users\Admin\AppData\Local\Temp\c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe
"C:\Users\Admin\AppData\Local\Temp\c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\delete.bat" "
  2⤵
  PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\delete.bat

Filesize
70B

MD5
2dec7b4e8c057539a70d92871e25de01

SHA1
7ebe1784ead75478ce04a3e19b98e3199389b9fd

SHA256
2ae41c431228fdddafd31113b62891a6f219272b7e5cd95f7679a8dfd4519d36

SHA512
0da17b940d4616c2323bcf9d3bfe03707d6b841b414d50e4730dacc18221d0788a29331186c2102eb78f9166dc318efcdd68aa5dcbe1c1f5531ce5c7c76afd67

Download Submit