f53f32200008e8c1d15f7996765d15070390f1781b3a2daa22f3d5a4e3409589

Analysis

max time kernel
90s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f53f32200008e8c1d15f7996765d15070390f1781b3a2daa22f3d5a4e3409589.exe
Size

119KB
MD5

1255bbf0c86dd73d54ac109e3cbab1e0
SHA1

bd45d3d65caa6d9cacd287e9c3be70f9dd18550e
SHA256

f53f32200008e8c1d15f7996765d15070390f1781b3a2daa22f3d5a4e3409589
SHA512

b46ea3f30c3098f0f2807bede0abf240c563bc31373e21f18f1729d2534e47fae8accc9208b763921b149097110f914496987c4046d16abf9829f80b1502734b
SSDEEP

1536:CHXs+01N7VzCS7Y0ubDW0SiKShPXdlRt1Rksk9GdBm8YI6/PFDkF0/lB/NcU:Cp6ppKGDSxR/DBwrPFIFKn/NcU

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1944	2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	f53f32200008e8c1d15f7996765d15070390f1781b3a2daa22f3d5a4e3409589.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\2.exe	f53f32200008e8c1d15f7996765d15070390f1781b3a2daa22f3d5a4e3409589.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1180	f53f32200008e8c1d15f7996765d15070390f1781b3a2daa22f3d5a4e3409589.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1944	1180	f53f32200008e8c1d15f7996765d15070390f1781b3a2daa22f3d5a4e3409589.exe	81
PID 1180 wrote to memory of 1944	1180	f53f32200008e8c1d15f7996765d15070390f1781b3a2daa22f3d5a4e3409589.exe	81
PID 1180 wrote to memory of 1944	1180	f53f32200008e8c1d15f7996765d15070390f1781b3a2daa22f3d5a4e3409589.exe	81

C:\Users\Admin\AppData\Local\Temp\f53f32200008e8c1d15f7996765d15070390f1781b3a2daa22f3d5a4e3409589.exe
"C:\Users\Admin\AppData\Local\Temp\f53f32200008e8c1d15f7996765d15070390f1781b3a2daa22f3d5a4e3409589.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\2.exe
  "C:\Windows\2.exe"
  2⤵
  - Executes dropped EXE
  PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\2.exe

Filesize
111KB

MD5
ad1d3c78ad0c31f25e6180db4b15e7ae

SHA1
2234f93db40b8a21057f321aff4ae1af7e96cd5b

SHA256
e7a9b8caec787c651bd42d252f5a02b03e1457339e7be10b68264e6b29d0cc74

SHA512
da80c36bc739b45d44e772a74d832f350e970796573c6244ac441f0a832ebd89936b3f5be1b112b3a6969e5f93d106fcbddb9618c06b257c43b6865e2998789d

Download Submit
C:\Windows\2.exe

Filesize
111KB

MD5
ad1d3c78ad0c31f25e6180db4b15e7ae

SHA1
2234f93db40b8a21057f321aff4ae1af7e96cd5b

SHA256
e7a9b8caec787c651bd42d252f5a02b03e1457339e7be10b68264e6b29d0cc74

SHA512
da80c36bc739b45d44e772a74d832f350e970796573c6244ac441f0a832ebd89936b3f5be1b112b3a6969e5f93d106fcbddb9618c06b257c43b6865e2998789d

Download Submit
memory/1180-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1180-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1944-136-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download