316a4e536d5de5068d44191d1621e87c9905a530c8c96eb35f8d6fab593e8b2f

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

316a4e536d5de5068d44191d1621e87c9905a530c8c96eb35f8d6fab593e8b2f.exe
Size

308KB
MD5

29613037f6fb21d6b705de7c96dc124d
SHA1

dfc9034fbac801e4ed1963e2f6d0fa0a8baabff1
SHA256

316a4e536d5de5068d44191d1621e87c9905a530c8c96eb35f8d6fab593e8b2f
SHA512

4f98315032285245d22feafc539a76648f9fe9535b42346b8d31efa53ac9ce2be8f97c36ef5169f351cab4d9c8d430d0ac52ccc34b7839803288a4db1400541a
SSDEEP

6144:NY20AljuB28YZgqEPfS1fE1G5HZjYGGfTs9N1X5k9I7nIOR:NY20AljdZgBPfKfn6GGfTsD1SMR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	316a4e536d5de5068d44191d1621e87c9905a530c8c96eb35f8d6fab593e8b2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	316a4e536d5de5068d44191d1621e87c9905a530c8c96eb35f8d6fab593e8b2f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1452	2500	316a4e536d5de5068d44191d1621e87c9905a530c8c96eb35f8d6fab593e8b2f.exe	89
PID 2500 wrote to memory of 1452	2500	316a4e536d5de5068d44191d1621e87c9905a530c8c96eb35f8d6fab593e8b2f.exe	89
PID 2500 wrote to memory of 1452	2500	316a4e536d5de5068d44191d1621e87c9905a530c8c96eb35f8d6fab593e8b2f.exe	89

C:\Users\Admin\AppData\Local\Temp\316a4e536d5de5068d44191d1621e87c9905a530c8c96eb35f8d6fab593e8b2f.exe
"C:\Users\Admin\AppData\Local\Temp\316a4e536d5de5068d44191d1621e87c9905a530c8c96eb35f8d6fab593e8b2f.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\setups.js"
  2⤵
  PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\setups.js

Filesize
118B

MD5
0d33c396e850cb6dd49052d736d3d4f5

SHA1
1a4b7b839ec09aa38648414fd24d7cf8ab487ac8

SHA256
75fbdf33afbae377a9605871344c6fa5e51ebb7b066612ce259ab0d3141b0848

SHA512
9f88a87bc107071d520b682857eea7f588ba16bde7a8ac191ad2b83152263e56301732f5e6a0bc012bb97c29039ee5c9cfc5df806f34f2127444c3feb340be6f

Download Submit