e9e198e19c4f894bab4373340546c698793106ec46122f1f6c4a1d6897e14259

Analysis

max time kernel
90s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9e198e19c4f894bab4373340546c698793106ec46122f1f6c4a1d6897e14259.exe
Size

77KB
MD5

0ea318344b13227b30ad4dbe715d7b5b
SHA1

a27b4dc0e55ad785355eb12573945cd194ff0147
SHA256

e9e198e19c4f894bab4373340546c698793106ec46122f1f6c4a1d6897e14259
SHA512

53b7547812e1c242a498b98d66482481928a315fb235e3ec8d2816dd5fc1b80e6e18f05d3e3fd63d66789344afb940458dc51c7ab9d35c8fdd68070fca24f20f
SSDEEP

1536:AiQgzHtbweQi4C9bnWe7z9EQ3G2e7JqSbk4p:lQgzHKCNhWSGXVqz4p

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	e9e198e19c4f894bab4373340546c698793106ec46122f1f6c4a1d6897e14259.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 1236	3564	e9e198e19c4f894bab4373340546c698793106ec46122f1f6c4a1d6897e14259.exe	80
PID 3564 wrote to memory of 1236	3564	e9e198e19c4f894bab4373340546c698793106ec46122f1f6c4a1d6897e14259.exe	80
PID 3564 wrote to memory of 1236	3564	e9e198e19c4f894bab4373340546c698793106ec46122f1f6c4a1d6897e14259.exe	80

C:\Users\Admin\AppData\Local\Temp\e9e198e19c4f894bab4373340546c698793106ec46122f1f6c4a1d6897e14259.exe
"C:\Users\Admin\AppData\Local\Temp\e9e198e19c4f894bab4373340546c698793106ec46122f1f6c4a1d6897e14259.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Txp..bat" > nul 2> nul
  2⤵
  PID:1236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Txp..bat

Filesize
274B

MD5
7bbe7764e550aad1da4440d1105583a4

SHA1
40914acc98c7d050910357074917b8f5e0696e49

SHA256
bc1cbef72e7c2206291878b1ff30431702e2d28e9b2d59d667e647f6105e4691

SHA512
8e33626d4f40481fc3dce7d430cce2c762a0066ee1112811abe769e860be5722dbe7fc9957bd52faa369cf837d6d99b7de3eeb9e6a0a83bd156fee56a58f1952

Download Submit
memory/3564-132-0x0000000002190000-0x00000000021AC000-memory.dmp

Filesize
112KB

Download
memory/3564-133-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3564-135-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download