b014cb83947fdbc1b51606e0adb970c9e1ae38ece393fbad764f954094958706

Analysis

max time kernel
179s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b014cb83947fdbc1b51606e0adb970c9e1ae38ece393fbad764f954094958706.exe
Size

993KB
MD5

6381d729b6ec6be756b66198d69f24e9
SHA1

933be56a1c8877911db3682210463515a6fd852f
SHA256

b014cb83947fdbc1b51606e0adb970c9e1ae38ece393fbad764f954094958706
SHA512

4d9659bf1e9f2a25105c0fb0993102384f87257fa7be0400cb190a59ce1e340009c49f48a28439f0c5aedfba32ed4cbdba96761dad6dc29a35683ddbc1d96e30
SSDEEP

24576:Z4lavt0LkLL9IMixoEgeam6mE0V92Lqq9MmCS:okwkn9IMHeamD92eaPCS

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

7080.exe

pid process

4256 7080.exe

pid	process
4256	7080.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b014cb83947fdbc1b51606e0adb970c9e1ae38ece393fbad764f954094958706.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	b014cb83947fdbc1b51606e0adb970c9e1ae38ece393fbad764f954094958706.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b014cb83947fdbc1b51606e0adb970c9e1ae38ece393fbad764f954094958706.exe

description	pid	process	target process
PID 5100 wrote to memory of 4256	5100	b014cb83947fdbc1b51606e0adb970c9e1ae38ece393fbad764f954094958706.exe	7080.exe
PID 5100 wrote to memory of 4256	5100	b014cb83947fdbc1b51606e0adb970c9e1ae38ece393fbad764f954094958706.exe	7080.exe
PID 5100 wrote to memory of 4256	5100	b014cb83947fdbc1b51606e0adb970c9e1ae38ece393fbad764f954094958706.exe	7080.exe

C:\Users\Admin\AppData\Local\Temp\b014cb83947fdbc1b51606e0adb970c9e1ae38ece393fbad764f954094958706.exe
"C:\Users\Admin\AppData\Local\Temp\b014cb83947fdbc1b51606e0adb970c9e1ae38ece393fbad764f954094958706.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5100

C:\Users\Admin\AppData\Local\Temp\7080\7080.exe
"C:\Users\Admin\AppData\Local\Temp\7080\7080.exe"
2⤵
- Executes dropped EXE
PID:4256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7080\7080.exe

Filesize
138KB

MD5
df8070d60eeaa2e11902c007ad07cd7c

SHA1
8bf0b0fe998dde2b9b084b46ff7ffed8e713004a

SHA256
e5afd145922a4d52076a2ac7890a398130f858020d5037fe37893a30e44f7b5b

SHA512
0b192a8c65270be93d28a21237aaf8900fb7f983c6b39838fd24b8861384414ab160fe8eabfeddf0f231e838d436186d3b45d6d372923a3a6814c12ff747e469

Download Submit
C:\Users\Admin\AppData\Local\Temp\7080\7080.exe

Filesize
138KB

MD5
df8070d60eeaa2e11902c007ad07cd7c

SHA1
8bf0b0fe998dde2b9b084b46ff7ffed8e713004a

SHA256
e5afd145922a4d52076a2ac7890a398130f858020d5037fe37893a30e44f7b5b

SHA512
0b192a8c65270be93d28a21237aaf8900fb7f983c6b39838fd24b8861384414ab160fe8eabfeddf0f231e838d436186d3b45d6d372923a3a6814c12ff747e469

Download Submit
memory/4256-132-0x0000000000000000-mapping.dmp

Download