6ff96e56023abdb5d8d9df02df3fc880b49c4cd51740fba625cfcd525cfd4d78

Analysis

max time kernel
130s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 06:11

Target

6ff96e56023abdb5d8d9df02df3fc880b49c4cd51740fba625cfcd525cfd4d78.exe
Size

931KB
MD5

509655aadcf2aa035121ee3f53012440
SHA1

8e53f67572b808ef6fdba5903aae5ac0858d75b4
SHA256

6ff96e56023abdb5d8d9df02df3fc880b49c4cd51740fba625cfcd525cfd4d78
SHA512

338efd78c3c0443fdd0455afc29232242d78c4b109a74dbca70d59423664340be4da0912516481320d22788070b0e6b7d2ade2dce6dbd5087ba7e5f1a2ef7139
SSDEEP

12288:t2+sJjIg5YwPDgBg1LfqgrsIzxFXD7txpvGGsLK3yRDRhWv9iWLcjXP8t8q:oNT5ZFXD7fpeyyRRhy9lLcTFq

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	6ff96e56023abdb5d8d9df02df3fc880b49c4cd51740fba625cfcd525cfd4d78.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Zt59696.exe	6ff96e56023abdb5d8d9df02df3fc880b49c4cd51740fba625cfcd525cfd4d78.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
888	6ff96e56023abdb5d8d9df02df3fc880b49c4cd51740fba625cfcd525cfd4d78.exe
888	6ff96e56023abdb5d8d9df02df3fc880b49c4cd51740fba625cfcd525cfd4d78.exe

C:\Users\Admin\AppData\Local\Temp\6ff96e56023abdb5d8d9df02df3fc880b49c4cd51740fba625cfcd525cfd4d78.exe
"C:\Users\Admin\AppData\Local\Temp\6ff96e56023abdb5d8d9df02df3fc880b49c4cd51740fba625cfcd525cfd4d78.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:888
- C:\Program Files\duba_3_133.exe
  "C:\Program Files\duba_3_133.exe"
  2⤵
  PID:2624

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2624-135-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download