17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b

Analysis

max time kernel
153s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:41

Target

17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b.exe
Size

160KB
MD5

9faf3034ec3ee4dba75812f5afc41022
SHA1

71dc5de9d14242b660a62e6ca5178493f3c7d2de
SHA256

17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b
SHA512

b351698b67b03b2fa56f202dc5eed06f326b9ead2997d335b9a7022901d9538e6f131f28e0307fe98527c621265e22c7307ebad0387a849c42903e48bcf7245e
SSDEEP

3072:8sDV6Az1lWgFvYGnJd9KpZV3uTN9WU/G9h3Gw590KqWbmzALbvl6:tQAKgFvYGJd9KpZV3uTN9WU/G9h2w591

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b.exe
"C:\Users\Admin\AppData\Local\Temp\17ad6fab46d2dd310d35431212a076fe86a7a41df5b0200f12ef9a64295c530b.exe"
1⤵
- Checks computer location settings
PID:1260

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1260-132-0x00007FFCC7710000-0x00007FFCC8146000-memory.dmp

Filesize
10.2MB

Download