5f963c2b54eb2a8e7c2f1fd73b394cb7a3cdc424161c5966c192424c93977b6e

Analysis

max time kernel
105s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f963c2b54eb2a8e7c2f1fd73b394cb7a3cdc424161c5966c192424c93977b6e.exe
Size

21KB
MD5

24f9a38471e49cfa484b091b44aacd5a
SHA1

cc055dfba4900e9582c24ef5a6b3abd9d1203b52
SHA256

5f963c2b54eb2a8e7c2f1fd73b394cb7a3cdc424161c5966c192424c93977b6e
SHA512

bb1ec848b6579a3ce7e3570cd2a01dfdfca041216368403236034d36cc6cca88521a19687e9d9e48b88bd18d0de65240b2f4014e97c73f580a826a9503068f36
SSDEEP

192:ZXokc/wYXqa6qx94nkFLuyqcWeew4DoYeqgYzLYirYH1oyn9lsN8sv3hw/R/:WhLXqa6qH4mVqheen8YWKG1dsN8NR

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2972	ffxug.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5f963c2b54eb2a8e7c2f1fd73b394cb7a3cdc424161c5966c192424c93977b6e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2972	1780	5f963c2b54eb2a8e7c2f1fd73b394cb7a3cdc424161c5966c192424c93977b6e.exe	82
PID 1780 wrote to memory of 2972	1780	5f963c2b54eb2a8e7c2f1fd73b394cb7a3cdc424161c5966c192424c93977b6e.exe	82
PID 1780 wrote to memory of 2972	1780	5f963c2b54eb2a8e7c2f1fd73b394cb7a3cdc424161c5966c192424c93977b6e.exe	82

C:\Users\Admin\AppData\Local\Temp\5f963c2b54eb2a8e7c2f1fd73b394cb7a3cdc424161c5966c192424c93977b6e.exe
"C:\Users\Admin\AppData\Local\Temp\5f963c2b54eb2a8e7c2f1fd73b394cb7a3cdc424161c5966c192424c93977b6e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\ffxug.exe
  "C:\Users\Admin\AppData\Local\Temp\ffxug.exe"
  2⤵
  - Executes dropped EXE
  PID:2972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ffxug.exe

Filesize
21KB

MD5
4dfe25fc4b4310a521bc674747215258

SHA1
64613e5576dac5fc9c71834e32cd8a764dd9a4f8

SHA256
a264f2c21a5d1fb7bb5bf9f4e55f720c073c121d3af2c87bb37f6f79f09bad5e

SHA512
1e078d14fd6a1ea9a20d749ca671070c740957572006b6792de91155e0d78a630231459d9a69e9d241da0f17ddc90174e52b5b30bbdfa8e83a1c6e4199e34ec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ffxug.exe

Filesize
21KB

MD5
4dfe25fc4b4310a521bc674747215258

SHA1
64613e5576dac5fc9c71834e32cd8a764dd9a4f8

SHA256
a264f2c21a5d1fb7bb5bf9f4e55f720c073c121d3af2c87bb37f6f79f09bad5e

SHA512
1e078d14fd6a1ea9a20d749ca671070c740957572006b6792de91155e0d78a630231459d9a69e9d241da0f17ddc90174e52b5b30bbdfa8e83a1c6e4199e34ec2

Download Submit
memory/1780-135-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2972-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download