43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625

Analysis

max time kernel
87s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe
Size

1.1MB
MD5

20781fbaa7123fc73c8de56bca10794d
SHA1

3a815da83654d8454a1d092847a2a28efc4c408e
SHA256

43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625
SHA512

b4669a33e31220712fbe160f7e4b4242a7c6dc7a4544cd447a353a3e2fa304a7b2990ad6f0b7e7e719ec6efdd5ab731f30c146cfe90e9abc157bd221252ca1a9
SSDEEP

24576:w/0peow6/GmPN760aABzSbE0nc4v2o6IsQPTYDIH17GwoYS:vTbVSrz6nWH1GPh

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2312	search.cmd

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2312	search.cmd

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2312	2816	43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe	76
PID 2816 wrote to memory of 2312	2816	43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe	76
PID 2816 wrote to memory of 2312	2816	43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe	76
PID 2816 wrote to memory of 2840	2816	43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe	77
PID 2816 wrote to memory of 2840	2816	43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe	77
PID 2816 wrote to memory of 2840	2816	43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe	77

C:\Users\Admin\AppData\Local\Temp\43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe
"C:\Users\Admin\AppData\Local\Temp\43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del c:\users\admin\appdata\local\temp\43D89B~1.EXE >> NUL
  2⤵
  PID:2840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.1MB

MD5
20781fbaa7123fc73c8de56bca10794d

SHA1
3a815da83654d8454a1d092847a2a28efc4c408e

SHA256
43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625

SHA512
b4669a33e31220712fbe160f7e4b4242a7c6dc7a4544cd447a353a3e2fa304a7b2990ad6f0b7e7e719ec6efdd5ab731f30c146cfe90e9abc157bd221252ca1a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.1MB

MD5
20781fbaa7123fc73c8de56bca10794d

SHA1
3a815da83654d8454a1d092847a2a28efc4c408e

SHA256
43d89b21ae304c697c25c0f2e29bbb1901ca0b69368461a211a6f2f5be088625

SHA512
b4669a33e31220712fbe160f7e4b4242a7c6dc7a4544cd447a353a3e2fa304a7b2990ad6f0b7e7e719ec6efdd5ab731f30c146cfe90e9abc157bd221252ca1a9

Download Submit