e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9

Analysis

max time kernel
171s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe
Size

128KB
MD5

2f9f6a53c4123b7743496d4705f1f2df
SHA1

9d82079b9e1848b8df53105f15188ac958f55707
SHA256

e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9
SHA512

5ac08af27b3c85605f06218391325e74dfccd0c64159477aeb75b1f46e4fecd017d7c1f72a362201b59dabbf421bb22723884cbb4cce855b6d9655e169c6540e
SSDEEP

768:kDbM0G1aIeMT2eaxg83PuUeqTaeBBW+9BkhtLxzjroQTo2jzr/fDHLVQIAxQQ:knMDaacg8GtyTlML1VfjLHlAT

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
228	e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe
228	e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe

C:\Users\Admin\AppData\Local\Temp\e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe
"C:\Users\Admin\AppData\Local\Temp\e9b6156ffd73515cdb2817e4a89fced55fd399579c1d1f962a02d64caac74fc9.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads