32c6c5a9b932089663d4cf57ab3eb1f892d20e1d606e7c8b24209ed6d7f3f0a5

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

32c6c5a9b932089663d4cf57ab3eb1f892d20e1d606e7c8b24209ed6d7f3f0a5.exe
Size

110KB
MD5

05be8957892a8c5a3a0a5661a9c1c73f
SHA1

70521899e34622e0dc8518cefefbc72088de615e
SHA256

32c6c5a9b932089663d4cf57ab3eb1f892d20e1d606e7c8b24209ed6d7f3f0a5
SHA512

403ef2b4ce22eaa79bbdea87c12413ade0910a047fb2b8bc6a8dfab883d66c2beac6cf0e3600beb4e07b5d4c57476925bd56d98530ac915cffaf243aaf750082
SSDEEP

1536:KmTdCCqS287V6LPEidmw8Yx7wV2Iy2e42Zukek3jPILTCaEViHoFIb:tpCCqS28K7+YGIx2X2Zu0jIEBFIb

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	32c6c5a9b932089663d4cf57ab3eb1f892d20e1d606e7c8b24209ed6d7f3f0a5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	32c6c5a9b932089663d4cf57ab3eb1f892d20e1d606e7c8b24209ed6d7f3f0a5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2800	4892	32c6c5a9b932089663d4cf57ab3eb1f892d20e1d606e7c8b24209ed6d7f3f0a5.exe	81
PID 4892 wrote to memory of 2800	4892	32c6c5a9b932089663d4cf57ab3eb1f892d20e1d606e7c8b24209ed6d7f3f0a5.exe	81
PID 4892 wrote to memory of 2800	4892	32c6c5a9b932089663d4cf57ab3eb1f892d20e1d606e7c8b24209ed6d7f3f0a5.exe	81

C:\Users\Admin\AppData\Local\Temp\32c6c5a9b932089663d4cf57ab3eb1f892d20e1d606e7c8b24209ed6d7f3f0a5.exe
"C:\Users\Admin\AppData\Local\Temp\32c6c5a9b932089663d4cf57ab3eb1f892d20e1d606e7c8b24209ed6d7f3f0a5.exe"
1⤵
- Checks computer location settings
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Kbb..bat" > nul 2> nul
  2⤵
  PID:2800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Kbb..bat

Filesize
274B

MD5
9c2637aa202dda89d0a4be62ce2a8bca

SHA1
c2621d7f3cba79f505e0cf6bcf4ad84fc052a48f

SHA256
d4814004b1fa6e959f6d61adbfa25ae5ae57b344facbd4c82e9d1978058141c8

SHA512
cd20e92dd3b8b8f99ea753393f5d3e71c34543ddae2e5665306fa1f430dbaa12d7fbe90b90c0f793bcd4463eceb1ebf5522b3d2a4bbdc7201297d34b9a7a3c15

Download Submit
memory/4892-134-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4892-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads