b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6

Analysis

max time kernel
90s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe
Size

990KB
MD5

0915d8f3daac1432d07ea27b3b5be7fc
SHA1

cb4c2c45fa6ff37f9ef74a60e51874f5d2f5a2d4
SHA256

b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6
SHA512

fcd9bcfc42537bdac2a6506ac415613bd09bcf6ff3f87e08ac37baf95c607badc6c8c652696a86419e619405fd6430c7f8fe915b87fbb16496dcda33ef21bb78
SSDEEP

24576:Etb20pkaCqT5TBWgNQ7aLb0r6e0Vp1aAZ6A:tVg5tQ7af0r6e0pc65

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4500 set thread context of 408	4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe
4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe
4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe
4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe
4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 408	4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe	89
PID 4500 wrote to memory of 408	4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe	89
PID 4500 wrote to memory of 408	4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe	89
PID 4500 wrote to memory of 408	4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe	89
PID 4500 wrote to memory of 408	4500	b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe	89

C:\Users\Admin\AppData\Local\Temp\b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe
"C:\Users\Admin\AppData\Local\Temp\b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe
  "C:\Users\Admin\AppData\Local\Temp\b2bd1de24ee6827c7ce725b074d65351998f67643b7574fd059d49176f22e7b6.exe"
  2⤵
  - Checks computer location settings
  PID:408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-133-0x0000000000190000-0x00000000001B0000-memory.dmp

Filesize
128KB

Download
memory/408-134-0x0000000000190000-0x00000000001B0000-memory.dmp

Filesize
128KB

Download
memory/408-135-0x0000000000190000-0x00000000001B0000-memory.dmp

Filesize
128KB

Download
memory/408-136-0x0000000000190000-0x00000000001B0000-memory.dmp

Filesize
128KB

Download
memory/408-137-0x0000000000190000-0x00000000001B0000-memory.dmp

Filesize
128KB

Download