b3a17619b48f83312c69ff1267b9c91c5a56cd4e9f88b638110940ce17082e5a

Analysis

max time kernel
182s
max time network
257s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3a17619b48f83312c69ff1267b9c91c5a56cd4e9f88b638110940ce17082e5a.exe
Size

160KB
MD5

05755f088ade79f1b8c1a1b1d7e93c12
SHA1

c73f8e1e92c2a7ef671a3515110c280fee771a87
SHA256

b3a17619b48f83312c69ff1267b9c91c5a56cd4e9f88b638110940ce17082e5a
SHA512

5ed422cf3939a4e37ff4ed1a52fe8a59c58cb5f937b86afee88541c9279252ce22d28edfd039b2bf2265455a78717280e04f336d9c0a85df3f6674b68a2652e5
SSDEEP

3072:8sDV6Az1lWgFvYGnJd6KpZV3uEN9WU/G9h3Gw590KqWbmzALbvl6:tQAKgFvYGJd6KpZV3uEN9WU/G9h2w591

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	b3a17619b48f83312c69ff1267b9c91c5a56cd4e9f88b638110940ce17082e5a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\b3a17619b48f83312c69ff1267b9c91c5a56cd4e9f88b638110940ce17082e5a.exe
"C:\Users\Admin\AppData\Local\Temp\b3a17619b48f83312c69ff1267b9c91c5a56cd4e9f88b638110940ce17082e5a.exe"
1⤵
- Checks computer location settings
PID:4940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4940-132-0x00007FFD761F0000-0x00007FFD76C26000-memory.dmp

Filesize
10.2MB

Download