5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d

Analysis

max time kernel
154s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe
Size

177KB
MD5

3b8c8f1085a79b00ddc946df241e50db
SHA1

d072e577aaf8e906578827f76eaceeb7898aebb1
SHA256

5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d
SHA512

a79654f764ddc37b17a860e80426f2696c06da5d39aebeb32ac8b21e34a27d2d831a933b3428b4ad23730016ecd4a85051994a5046a4083e57fa71de01ae7205
SSDEEP

3072:8onLoLYT67BJjrPb468PRs6VAqFa6Z/jZir5g2N8yGDp+mSX:PnLo8W7PPb4pdVAAjI+t

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1340	2104	5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe	79
PID 2104 wrote to memory of 1340	2104	5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe	79
PID 2104 wrote to memory of 1340	2104	5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe	79

C:\Users\Admin\AppData\Local\Temp\5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe
"C:\Users\Admin\AppData\Local\Temp\5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ovv..bat" > nul 2> nul
  2⤵
  PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ovv..bat

Filesize
274B

MD5
b60694427d0f2f6f2c279715d59979b1

SHA1
d8e2c32e94023e53f1444a60a22284f88a2b6e37

SHA256
17b49a992b55c35863e8c1d9d0dc6e40be5df0333702b5fbf09bb34cd5d55535

SHA512
2e3e49da477757dc0f9922ff94d4ec08b221e2489e0930c7e8a6185ff871a8d33949b2399d7669d25a515135983608bba24f5996b07a28affc7e7741ed2ae6a1

Download Submit
memory/2104-132-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download
memory/2104-133-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2104-134-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2104-136-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download