47d2dd01fdd570406adf66c7ebec26348f6cab6c73718b701f4dcedab38867f1

Analysis

max time kernel
150s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

47d2dd01fdd570406adf66c7ebec26348f6cab6c73718b701f4dcedab38867f1.exe
Size

993KB
MD5

095501e94845992bd4e7a391d64fc2b4
SHA1

6e72a1f189c34b61ce66b7548c538bd30d242659
SHA256

47d2dd01fdd570406adf66c7ebec26348f6cab6c73718b701f4dcedab38867f1
SHA512

c2085477aedb3650464a2d79808a545e672ce935a51e8efcb1676b273b2ae233a98f9e8dc4dbca6e4fdeaba093a6a52f1d5c027d3f2eec437b02f7231eebfd26
SSDEEP

24576:P4lavt0LkLL9IMixoEgeaBwktAuq9MmCS:Kkwkn9IMHeaBVDaPCS

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3520	2202.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	47d2dd01fdd570406adf66c7ebec26348f6cab6c73718b701f4dcedab38867f1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3520	3176	47d2dd01fdd570406adf66c7ebec26348f6cab6c73718b701f4dcedab38867f1.exe	84
PID 3176 wrote to memory of 3520	3176	47d2dd01fdd570406adf66c7ebec26348f6cab6c73718b701f4dcedab38867f1.exe	84
PID 3176 wrote to memory of 3520	3176	47d2dd01fdd570406adf66c7ebec26348f6cab6c73718b701f4dcedab38867f1.exe	84

C:\Users\Admin\AppData\Local\Temp\47d2dd01fdd570406adf66c7ebec26348f6cab6c73718b701f4dcedab38867f1.exe
"C:\Users\Admin\AppData\Local\Temp\47d2dd01fdd570406adf66c7ebec26348f6cab6c73718b701f4dcedab38867f1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\2202\2202.exe
  "C:\Users\Admin\AppData\Local\Temp\2202\2202.exe"
  2⤵
  - Executes dropped EXE
  PID:3520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2202\2202.exe

Filesize
138KB

MD5
b0b75d345f2c65c7e44f827f58225517

SHA1
ac0f12110c64e507d06367d81302e818ec37a856

SHA256
c7bf96b45684eff510710e3727ed43b64bc13b327400e99cc238713718a10ebd

SHA512
3a52b31eb7a381e7bac0f8b6dc564bb8297ea857670d991696c19058d9d0cd499fa1fc8a767e0aa0cf3a31b42e279048868eabc1790cf7402a0ce05581650f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2202\2202.exe

Filesize
138KB

MD5
b0b75d345f2c65c7e44f827f58225517

SHA1
ac0f12110c64e507d06367d81302e818ec37a856

SHA256
c7bf96b45684eff510710e3727ed43b64bc13b327400e99cc238713718a10ebd

SHA512
3a52b31eb7a381e7bac0f8b6dc564bb8297ea857670d991696c19058d9d0cd499fa1fc8a767e0aa0cf3a31b42e279048868eabc1790cf7402a0ce05581650f8c

Download Submit