b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe
Size

540KB
MD5

836889f1844bcc4b0d45c076dddc9e60
SHA1

43f5db0eec96f26fcce318bdaa387cf97e608efe
SHA256

b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a
SHA512

f5182fca19a41b66e6f39cff41ca2c2434d6f2ae6152344e1b0864b3a098a6966c602ad9e8e813bd01f88dacd63bccd1b59bd4d859934ac16c3854390e1f54e5
SSDEEP

12288:S9XdVx1+9jsFIezPTWuljbv95k92tVpg3:a/EjsFI0Fd9A2tVpo

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\sppert.ini	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3168	1656	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe	79
PID 1656 wrote to memory of 3168	1656	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe	79
PID 1656 wrote to memory of 3168	1656	b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe	79

C:\Users\Admin\AppData\Local\Temp\b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe
"C:\Users\Admin\AppData\Local\Temp\b41123a8b2467b28165b0f930e1c12827055eb185e5e9477a8d96336722f278a.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DelTemp.bat" "
  2⤵
  PID:3168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DelTemp.bat

Filesize
187B

MD5
a937df466bb1cec01b78b85f7d750306

SHA1
a486c28051ace0e133a3210dea5de480ed931257

SHA256
cfbf50625c150e395e83ff255c37369909b9f5aadc573f7c09e7466206bc4a0a

SHA512
4b767925755688b42e6ccb5dfcf144351c8dc837da9b88bdb7b70790865cc3e9227cef9940d71fde2b8a6eacf50e0befcc72f085bea275424ee106ab1add8786

Download Submit