e7a513b8ea6798965ac7ab85da1b5f533e1d6a0bf9833c2fbc8dc18c6c18a45c

Analysis

max time kernel
190s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7a513b8ea6798965ac7ab85da1b5f533e1d6a0bf9833c2fbc8dc18c6c18a45c.exe
Size

160KB
MD5

095cedd948771823db8cf5d3fd59aa02
SHA1

937f6e99d1864c6bb87d8aa13204ebcd5a9d4802
SHA256

e7a513b8ea6798965ac7ab85da1b5f533e1d6a0bf9833c2fbc8dc18c6c18a45c
SHA512

fd0a04454b7dcf60eead4195a9ea805ca8b379701f330d04d7bc6d9af550b93f31211261b11b52bb595a435791b264e01543fbe1963e2194bef8168c3d78f1c8
SSDEEP

3072:8sDV6Az1gWgFvYGnJd6KpZV3uTN9WU/G9h3Gw590KqkbmzALbvl6:tQArgFvYGJd6KpZV3uTN9WU/G9h2w59X

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	e7a513b8ea6798965ac7ab85da1b5f533e1d6a0bf9833c2fbc8dc18c6c18a45c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\e7a513b8ea6798965ac7ab85da1b5f533e1d6a0bf9833c2fbc8dc18c6c18a45c.exe
"C:\Users\Admin\AppData\Local\Temp\e7a513b8ea6798965ac7ab85da1b5f533e1d6a0bf9833c2fbc8dc18c6c18a45c.exe"
1⤵
- Checks computer location settings
PID:968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-132-0x00007FFE7F8A0000-0x00007FFE802D6000-memory.dmp

Filesize
10.2MB

Download