47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179.exe
Size

1.8MB
MD5

93b6742c20591f034168ed011ee95ccc
SHA1

d75ca95c465842f63824430504619ebbf0e2a766
SHA256

47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179
SHA512

ce710556a54c3dc28ebabc5e37b3d1a9dacf26a8b70397b7a6f7872822264f360e7ca76b42571cca0123a03f173c8256a9edd983792e0d1bebfd4d7a7c81e95d
SSDEEP

49152:vUbqTpTbGPJWf7Pza/oy2bPTiti4p8p0mJ:HTbKO6g3bb2r85

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1260	langpack_es.exe
4496	tish.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 1260	4760	47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179.exe	84
PID 4760 wrote to memory of 1260	4760	47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179.exe	84
PID 4760 wrote to memory of 1260	4760	47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179.exe	84
PID 4760 wrote to memory of 4496	4760	47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179.exe	85
PID 4760 wrote to memory of 4496	4760	47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179.exe	85
PID 4760 wrote to memory of 4496	4760	47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179.exe	85

C:\Users\Admin\AppData\Local\Temp\47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179.exe
"C:\Users\Admin\AppData\Local\Temp\47d7ce255f28ef8cc845d39c4723551c714a38803954bfb56426d7299e27c179.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\nsnDB15.tmp\langpack_es.exe
  "C:\Users\Admin\AppData\Local\Temp\nsnDB15.tmp\langpack_es.exe"
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Users\Admin\AppData\Local\Temp\nsnDB15.tmp\tish.exe
  "C:\Users\Admin\AppData\Local\Temp\nsnDB15.tmp\tish.exe"
  2⤵
  - Executes dropped EXE
  PID:4496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsnDB15.tmp\langpack_es.exe

Filesize
1.8MB

MD5
05cc055fd6ab4ffa5183e5307cb31e1a

SHA1
4707de45bc268f96692011e18347b88fe15e9cc8

SHA256
a30a9b9fb07718a42c4f05eba2d278bab57593c486257abef8a7a2dadf2253db

SHA512
6eb76e891912da66d696d0077907a65d1c03eab20a292acdb74bd4b363ef715f3749299bd6d70170f9ea8da55671b00e2b0c051a9ce60de140896b9d4f88e2ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDB15.tmp\langpack_es.exe

Filesize
1.8MB

MD5
05cc055fd6ab4ffa5183e5307cb31e1a

SHA1
4707de45bc268f96692011e18347b88fe15e9cc8

SHA256
a30a9b9fb07718a42c4f05eba2d278bab57593c486257abef8a7a2dadf2253db

SHA512
6eb76e891912da66d696d0077907a65d1c03eab20a292acdb74bd4b363ef715f3749299bd6d70170f9ea8da55671b00e2b0c051a9ce60de140896b9d4f88e2ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDB15.tmp\tish.exe

Filesize
7KB

MD5
28ac32071d72f7dd657adbee25b04b97

SHA1
5c23720df5939c366f34e08c56f00c5e7728261d

SHA256
f620d4d30c06611822e3cff1ecc87bb3a5cacfc008f135c99a45a36806dde3fe

SHA512
02fe1364027b92e750b8d3b8b65c3ae09f907ea86761030b9036d4a8a6d2b785077342dd98373860ce84a89545002bbeb3a797bd01be0b8af775a675df11173d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnDB15.tmp\tish.exe

Filesize
7KB

MD5
28ac32071d72f7dd657adbee25b04b97

SHA1
5c23720df5939c366f34e08c56f00c5e7728261d

SHA256
f620d4d30c06611822e3cff1ecc87bb3a5cacfc008f135c99a45a36806dde3fe

SHA512
02fe1364027b92e750b8d3b8b65c3ae09f907ea86761030b9036d4a8a6d2b785077342dd98373860ce84a89545002bbeb3a797bd01be0b8af775a675df11173d

Download Submit