12ee85d2de3fa642d2a93bc7cbf0b2ba0de1355c8771759d26f0b6560391c2e8

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12ee85d2de3fa642d2a93bc7cbf0b2ba0de1355c8771759d26f0b6560391c2e8.exe
Size

15KB
MD5

203aee4620ac7d9b9cc09e48bba480f0
SHA1

9417f8238871478a9ea2ad9cee0c711257b43210
SHA256

12ee85d2de3fa642d2a93bc7cbf0b2ba0de1355c8771759d26f0b6560391c2e8
SHA512

6f3949bf2bbf3b80bb36dfa9b85ed4556c1402be2df46e15ca8d85e305405f12beefb64c878dd35a60558a8e58de9c3540973dbbf401cc5d0a8d147d5c7cfcb4
SSDEEP

192:GGjb4DLDb9J7tFWAy+BYTYx+qh/hTUohEHtHlQ:GGjw95yGiZqhpTUohItFQ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4660	fcaip.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	12ee85d2de3fa642d2a93bc7cbf0b2ba0de1355c8771759d26f0b6560391c2e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 4660	1984	12ee85d2de3fa642d2a93bc7cbf0b2ba0de1355c8771759d26f0b6560391c2e8.exe	80
PID 1984 wrote to memory of 4660	1984	12ee85d2de3fa642d2a93bc7cbf0b2ba0de1355c8771759d26f0b6560391c2e8.exe	80
PID 1984 wrote to memory of 4660	1984	12ee85d2de3fa642d2a93bc7cbf0b2ba0de1355c8771759d26f0b6560391c2e8.exe	80

C:\Users\Admin\AppData\Local\Temp\12ee85d2de3fa642d2a93bc7cbf0b2ba0de1355c8771759d26f0b6560391c2e8.exe
"C:\Users\Admin\AppData\Local\Temp\12ee85d2de3fa642d2a93bc7cbf0b2ba0de1355c8771759d26f0b6560391c2e8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\fcaip.exe
  "C:\Users\Admin\AppData\Local\Temp\fcaip.exe"
  2⤵
  - Executes dropped EXE
  PID:4660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fcaip.exe

Filesize
16KB

MD5
eac2134d542a81fb3e4654a824c88d88

SHA1
1e563d154ca5b9bdffe626dc39a15308c9e72434

SHA256
12099c4c2b180cf6b20ded6ad4b0c4be45ff6a9163e9ef663602b79687b7851d

SHA512
5fa2eca7ccd012ac47000bd18684b3c965af2db5ecf3e19af264f71b78e5e489eb7467e4f25209c8d795d1667a9447fd627ed7c5840724d2932bb5be34afb2de

Download Submit
C:\Users\Admin\AppData\Local\Temp\fcaip.exe

Filesize
16KB

MD5
eac2134d542a81fb3e4654a824c88d88

SHA1
1e563d154ca5b9bdffe626dc39a15308c9e72434

SHA256
12099c4c2b180cf6b20ded6ad4b0c4be45ff6a9163e9ef663602b79687b7851d

SHA512
5fa2eca7ccd012ac47000bd18684b3c965af2db5ecf3e19af264f71b78e5e489eb7467e4f25209c8d795d1667a9447fd627ed7c5840724d2932bb5be34afb2de

Download Submit