a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461

Analysis

max time kernel
93s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe
Size

1.1MB
MD5

0b15143903635fafae49dbf03407af7b
SHA1

632008a3f5b2d730826e6a95a260e36e38b7d7b0
SHA256

a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461
SHA512

9efb69260332cb0f9011c939eae1349710317b611877351d3c607a5811b4fc216e779e16199e6c40fd7aad56d7376cfc0df0c5c29f86470f28ccce0f7625fac4
SSDEEP

24576:ww0peow6/GmPN760aABzSbE0nc4v2o6IsQPTYDIH17GwoYw:oTbVSrz6nWH1GP/

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3512	search.cmd

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3512	search.cmd

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 3512	3888	a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe	84
PID 3888 wrote to memory of 3512	3888	a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe	84
PID 3888 wrote to memory of 3512	3888	a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe	84
PID 3888 wrote to memory of 2904	3888	a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe	85
PID 3888 wrote to memory of 2904	3888	a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe	85
PID 3888 wrote to memory of 2904	3888	a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe	85

C:\Users\Admin\AppData\Local\Temp\a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe
"C:\Users\Admin\AppData\Local\Temp\a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del c:\users\admin\appdata\local\temp\A61883~1.EXE >> NUL
  2⤵
  PID:2904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.1MB

MD5
0b15143903635fafae49dbf03407af7b

SHA1
632008a3f5b2d730826e6a95a260e36e38b7d7b0

SHA256
a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461

SHA512
9efb69260332cb0f9011c939eae1349710317b611877351d3c607a5811b4fc216e779e16199e6c40fd7aad56d7376cfc0df0c5c29f86470f28ccce0f7625fac4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.1MB

MD5
0b15143903635fafae49dbf03407af7b

SHA1
632008a3f5b2d730826e6a95a260e36e38b7d7b0

SHA256
a618835791803658f70206b7f697165cecd1ad532c8f14e49bc93d3a0a133461

SHA512
9efb69260332cb0f9011c939eae1349710317b611877351d3c607a5811b4fc216e779e16199e6c40fd7aad56d7376cfc0df0c5c29f86470f28ccce0f7625fac4

Download Submit