2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce

Analysis

max time kernel
175s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe
Size

113KB
MD5

c6ecd0525cbba00ceb699766c40b58fd
SHA1

0c64822f2925ab250c60076a2a6f61f449e7d75d
SHA256

2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce
SHA512

83a1304b385e0ef4fa7d62b0a7f1590bc733e4a2129de8ecb1bcaca6984a4ae1ae5034fb1467503693b36ebc002707e15b720f55b5da0cb04f9418a5f9a98a01
SSDEEP

3072:8emcyqFcEJrRL5JbfHmTy6ol2M5bh85VN+umgLFIq:8i1Fz7mMkc18PNIgJ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe

description	pid	process	target process
PID 4736 wrote to memory of 4988	4736	2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe	cmd.exe
PID 4736 wrote to memory of 4988	4736	2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe	cmd.exe
PID 4736 wrote to memory of 4988	4736	2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe
"C:\Users\Admin\AppData\Local\Temp\2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4736

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Hwv..bat" > nul 2> nul
2⤵
PID:4988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Hwv..bat

Filesize
274B

MD5
1ad27a29578d1b130f79651a6bcdcbc8

SHA1
1f0d3c01f7ccf1f7128d83818e2309664f092381

SHA256
329cf9fcb6134c40bd3390936a546d78ada7fb2109972cd3dec0ee9b4fcd433b

SHA512
486db0246880cf7c575352d9851b39a3eecc046094ab0fede70f033052cb3f82458c513fea9e7034fb7c9fbf63b0419d3dccac5cdf2d7b4c894d7fd574428076

Download Submit
memory/4736-132-0x0000000000400000-0x0000000000420A00-memory.dmp

Filesize
130KB

Download
memory/4736-134-0x0000000000400000-0x0000000000420A00-memory.dmp

Filesize
130KB

Download
memory/4988-133-0x0000000000000000-mapping.dmp

Download