ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315

Analysis

max time kernel
71s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.exe
Size

32KB
MD5

d5d1d5c11a9c83f9fa2f9629bf17fa64
SHA1

a4167315451ad9d426574f089e56ab3b93183acb
SHA256

ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315
SHA512

2a9f899d898f494e95a022ba4cfb3709bb47f9dc557960721b96cbcce6124c711ef6fcd4c2f4d2641ed2814512773aec624c7620375c148ccec607f974012a2f
SSDEEP

384:gjEJ2U6LCEudFyhOzHJowpXB0CRboDGSnzV:JQ9Kd+Bz

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

4568 tasklist.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tasklist.exe

description pid process

Token: SeDebugPrivilege 4568 tasklist.exe

pid	process
4568	tasklist.exe

description	pid	process
Token: SeDebugPrivilege	4568	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.exe

pid	process
960	ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.exe
960	ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.execmd.exe

description	pid	process	target process
PID 960 wrote to memory of 2080	960	ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.exe	cmd.exe
PID 960 wrote to memory of 2080	960	ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.exe	cmd.exe
PID 960 wrote to memory of 2080	960	ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.exe	cmd.exe
PID 2080 wrote to memory of 4568	2080	cmd.exe	tasklist.exe
PID 2080 wrote to memory of 4568	2080	cmd.exe	tasklist.exe
PID 2080 wrote to memory of 4568	2080	cmd.exe	tasklist.exe

C:\Users\Admin\AppData\Local\Temp\ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.exe
"C:\Users\Admin\AppData\Local\Temp\ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del ac6229b847b492e1f47bbcb011fffe50ac5a8006685fbb920d0b3e0763fc4315.com
2⤵
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-135-0x0000000000000000-mapping.dmp

Download
memory/4568-136-0x0000000000000000-mapping.dmp

Download