7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3.exe
Size

14KB
MD5

8247e2646dce669307da4b5356990820
SHA1

65d37e5a02b387876bda471ef3da9397ca2d8405
SHA256

7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3
SHA512

3d5a7cebf2f5a974b3a86ca873035bbef9e3c359f319bc10b5be543dc22263e748cd32a45156f3138533a6c954b80330a564f150d9015ff4bd48e57ad09c4d86
SSDEEP

192:neJfRWCRM3Qzff42KU2C5spULmwQXd3z9EUmv/CUyYvQKqdjUW2fum58ajK6UiZR:0ogE4A2b2CCp3qjyYYKUCr5/DHcRG

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
564	window updata.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vadgadg = "\"C:\\windows\\window updata.exe\""	window updata.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\window updata.exe	7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3.exe
File opened for modification	\??\c:\windows\window updata.exe	7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 564	3460	7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3.exe	79
PID 3460 wrote to memory of 564	3460	7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3.exe	79
PID 3460 wrote to memory of 564	3460	7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3.exe	79

C:\Users\Admin\AppData\Local\Temp\7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3.exe
"C:\Users\Admin\AppData\Local\Temp\7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3460
- C:\windows\window updata.exe
  "C:\windows\window updata.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\window updata.exe

Filesize
14KB

MD5
8247e2646dce669307da4b5356990820

SHA1
65d37e5a02b387876bda471ef3da9397ca2d8405

SHA256
7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3

SHA512
3d5a7cebf2f5a974b3a86ca873035bbef9e3c359f319bc10b5be543dc22263e748cd32a45156f3138533a6c954b80330a564f150d9015ff4bd48e57ad09c4d86

Download Submit
C:\windows\window updata.exe

Filesize
14KB

MD5
8247e2646dce669307da4b5356990820

SHA1
65d37e5a02b387876bda471ef3da9397ca2d8405

SHA256
7e7b0ca02a0a601be5a08d04c09aa5b29d2e0e500a2ea9b431e15fa6dee540b3

SHA512
3d5a7cebf2f5a974b3a86ca873035bbef9e3c359f319bc10b5be543dc22263e748cd32a45156f3138533a6c954b80330a564f150d9015ff4bd48e57ad09c4d86

Download Submit
memory/564-137-0x0000000000400000-0x000000000101A000-memory.dmp

Filesize
12.1MB

Download
memory/564-138-0x0000000000400000-0x000000000101A000-memory.dmp

Filesize
12.1MB

Download
memory/3460-132-0x0000000000400000-0x000000000101A000-memory.dmp

Filesize
12.1MB

Download
memory/3460-136-0x0000000000400000-0x000000000101A000-memory.dmp

Filesize
12.1MB

Download