3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80.exe
Size

12KB
MD5

0599481873dfe03c9fdd8e0232f04660
SHA1

08fb56132f1780a76eacffb5b69d389d2256af3d
SHA256

3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80
SHA512

a56f999737dc4f826c33408ea449855cca0350ecc7b6fc9a9d0b371e4bb1437cfd76b2f9884f6bc015133766feca4b3893083f605e25ec16b232144712846bc1
SSDEEP

192:y73dbdNcUv2maoJfnM5kCFKkYXPS74wLdZNhyWCh3dWKsGX7tMEYGJOxTx3Wqgqt:ypbdN3v2vopbCFgKUI7NhyhhtWKsEX2X

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1096-132-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/1096-133-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID	3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl	3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\multimediaControls.chl\CLSID\ = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"	3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1444	1096	3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80.exe	87
PID 1096 wrote to memory of 1444	1096	3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80.exe	87
PID 1096 wrote to memory of 1444	1096	3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80.exe	87

C:\Users\Admin\AppData\Local\Temp\3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80.exe
"C:\Users\Admin\AppData\Local\Temp\3c20d1792a6c74babe6e53741a0e2efd4e0cfcfe0357aae4a1bf825c88e7cc80.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_off0.bat" "
  2⤵
  PID:1444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_off0.bat

Filesize
338B

MD5
cdbb89e4f857bf86c46e40941f53d598

SHA1
b7ac7998b493152033cd1c4971193f22c8b24c2e

SHA256
de2bf23865f43051d478a19452e41ede2bb5933ad619b8a99fe43f0b1c1b0456

SHA512
c007a18c8b2e7db1a321892e89b3d11d60e1ddfd3e2e148b630b814fbca1566e71641aae3c74dae996804daa906afdbbca8b83d6d1272079e192a8f335d8aa2f

Download Submit
memory/1096-132-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1096-133-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download