1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97

Analysis

max time kernel
204s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe
Size

19KB
MD5

56a4d509c6c9274f5c8081c67246e277
SHA1

7bf6c5011b70444f8dc12bed0e0128aa0c2a8ef8
SHA256

1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97
SHA512

00abc365ebf48c2584da43f7c7824f10704e68aad4ba244dd90a56ee15641d5006735cde758057cc16ae161da9ad399164a594738369d647d95148f9a86184ef
SSDEEP

192:Mmd9B9FPH1M1kTpocHSpL4cJtIo/0kIGwKaaaaOaaakAdtCZ3Wdm:Mm9PH4xUUIo/LwktGG4

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

defnx.exe

pid process

2868 defnx.exe

pid	process
2868	defnx.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe

description	pid	process	target process
PID 4980 wrote to memory of 2868	4980	1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe	defnx.exe
PID 4980 wrote to memory of 2868	4980	1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe	defnx.exe
PID 4980 wrote to memory of 2868	4980	1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe	defnx.exe

C:\Users\Admin\AppData\Local\Temp\1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe
"C:\Users\Admin\AppData\Local\Temp\1f0bc9e2300054c9924b47f76a8570963daa890a7c78db47db74c8468de3fc97.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4980

C:\Users\Admin\AppData\Local\Temp\defnx.exe
"C:\Users\Admin\AppData\Local\Temp\defnx.exe"
2⤵
- Executes dropped EXE
PID:2868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\defnx.exe
Filesize
19KB

MD5
41129531069e47f24d9e615ba75eb36d

SHA1
718f6bae382ed8b917ddfb1dabd7b637b052b3e2

SHA256
c83d5e31ac3cab0406c84e535af72c7ac7822e4cb3637d1482ef22c39d455c15

SHA512
109317bf557dae04e0f046adb1b2df28ee78619842959dabb643c23a3b5efd9d87bf05ba81daeec0f019b5bb13404473b2db80fdbe5c119fa7a96ea8a0b53af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\defnx.exe
Filesize
19KB

MD5
41129531069e47f24d9e615ba75eb36d

SHA1
718f6bae382ed8b917ddfb1dabd7b637b052b3e2

SHA256
c83d5e31ac3cab0406c84e535af72c7ac7822e4cb3637d1482ef22c39d455c15

SHA512
109317bf557dae04e0f046adb1b2df28ee78619842959dabb643c23a3b5efd9d87bf05ba81daeec0f019b5bb13404473b2db80fdbe5c119fa7a96ea8a0b53af7

Download Submit
memory/2868-132-0x0000000000000000-mapping.dmp

Download