6197434ab725fdd3dc651c8ea065d34e71fec216581b69809f5b2beacb18607a

Analysis

max time kernel
6s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6197434ab725fdd3dc651c8ea065d34e71fec216581b69809f5b2beacb18607a.exe
Size

288KB
MD5

8497e014438407b996c90a6c1da1788c
SHA1

3d62aab83b0bf7b26dcd06fe065f240262650dbf
SHA256

6197434ab725fdd3dc651c8ea065d34e71fec216581b69809f5b2beacb18607a
SHA512

f0675dbc199a547b5d820a3dadfa3bf8f346cce5a0320dedba6d52f5ab27ee15592a85240f2be8a7e20a1fb0c0787a662bb0dd72b7daed034c89a68838c518b5
SSDEEP

3072:4lg4RAkafy8P4pS1CWamRo3icR3KWAQaKlJcoLbCkXXmBXjIkc:h4DS4k1Cgq3LeocLkXXmZZ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid
PID 4560 wrote to memory of 1740	4560
PID 4560 wrote to memory of 1740	4560
PID 4560 wrote to memory of 1740	4560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads