a6b1d10c312b7cef28f9956566c93410b8b91db966b7188290b4cf7fb5ec0c27

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6b1d10c312b7cef28f9956566c93410b8b91db966b7188290b4cf7fb5ec0c27.exe
Size

3.3MB
MD5

63f06729e6457ce47ff718bc103d7750
SHA1

ad86c7fa5df1b5cbbf5c7e97e3d1e4b0b5d28ac2
SHA256

a6b1d10c312b7cef28f9956566c93410b8b91db966b7188290b4cf7fb5ec0c27
SHA512

6b2d1a5632a83f87d7109fb1ab69d98440dd03cb352b4345ca1e01b9837e79526271bc37e1be0fc252f82c18b19a5df432bed074d32d3731d2f47344946e9ebd
SSDEEP

49152:ksX/89pHchWUIYNO8IWhU4OA7I3yUSR7v07pmPoTAIA9ktw3suwtTgX7IqnLwcXL:DX/qHwWPYA8IWh3mSRApLAgxuwe0LUKY

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4976	PicEdit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	a6b1d10c312b7cef28f9956566c93410b8b91db966b7188290b4cf7fb5ec0c27.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4976	3444	a6b1d10c312b7cef28f9956566c93410b8b91db966b7188290b4cf7fb5ec0c27.exe	82
PID 3444 wrote to memory of 4976	3444	a6b1d10c312b7cef28f9956566c93410b8b91db966b7188290b4cf7fb5ec0c27.exe	82
PID 3444 wrote to memory of 4976	3444	a6b1d10c312b7cef28f9956566c93410b8b91db966b7188290b4cf7fb5ec0c27.exe	82

C:\Users\Admin\AppData\Local\Temp\a6b1d10c312b7cef28f9956566c93410b8b91db966b7188290b4cf7fb5ec0c27.exe
"C:\Users\Admin\AppData\Local\Temp\a6b1d10c312b7cef28f9956566c93410b8b91db966b7188290b4cf7fb5ec0c27.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PicEdit.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PicEdit.exe"
  2⤵
  - Executes dropped EXE
  PID:4976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Media\Effects.dat

Filesize
319KB

MD5
860a6b6fa1dcce7250bd15c2e504e069

SHA1
d12d015c7cce8a791581fcd1c4a2ed921c007dc3

SHA256
b912ec5511e72ecfa4aa6328705db68521fce909120052c4112fbe09427930ed

SHA512
e5680657a854067051259780ef0a808e4ac0886b8024130ac72d7bd0935542c0e5058ca0c175a4011b9c493552c7968fcadf6a809e7836ee7a7c54e4a1850bff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PicEdit.exe

Filesize
4.8MB

MD5
8a76f2a274f646b19b2ecc0495725eaa

SHA1
1ef698981a1808aca9c5806a1745fc04c4816b66

SHA256
7cb322bdcf07f1e12e9a83076466ba57157b21c5886b8070574e5ac1a7d34b22

SHA512
a8a447a0c39aff887995a797fff51db8e0813ccec444aa78d64311f888d8d8b5c360ac3cbb557e6fdfd14db63afea1adf4f12a8092e4fa573e2c6c9f21661c65

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PicEdit.exe

Filesize
4.8MB

MD5
8a76f2a274f646b19b2ecc0495725eaa

SHA1
1ef698981a1808aca9c5806a1745fc04c4816b66

SHA256
7cb322bdcf07f1e12e9a83076466ba57157b21c5886b8070574e5ac1a7d34b22

SHA512
a8a447a0c39aff887995a797fff51db8e0813ccec444aa78d64311f888d8d8b5c360ac3cbb557e6fdfd14db63afea1adf4f12a8092e4fa573e2c6c9f21661c65

Download Submit