5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691

Analysis

max time kernel
182s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe
Size

75KB
MD5

0a5cb74e673c5f0befc72e0f695fe89d
SHA1

5e5aacc711c6f21caecc787976735ee964b0a878
SHA256

5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691
SHA512

8a8d88707242a15510a9b83788ce8ac3fe0f2c0b52a244efcded3818d02b8ca1c16681125aa28171157b090ebc6baf122b149c8d6430f3859bedc45e2ac2588b
SSDEEP

1536:BbBsYVpIDyVT2eGgREZJvoFuCgq46DZkwLR:BbBvVpV2eGgR/gq4qZkaR

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe

pid process

624 5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe

pid	process
624	5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe

description	pid	process	target process
PID 624 wrote to memory of 1936	624	5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe	cmd.exe
PID 624 wrote to memory of 1936	624	5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe	cmd.exe
PID 624 wrote to memory of 1936	624	5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe
"C:\Users\Admin\AppData\Local\Temp\5eac98759ab4bea3d1b865348f667be2fd6fb0114e5066ca9010564e52ccc691.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Wbj..bat" > nul 2> nul
  2⤵
  PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wbj..bat

Filesize
274B

MD5
936919d8100dfb9a70989d574f673195

SHA1
da0cc7b96740a623a0ef43bffaa64e9322a1959d

SHA256
16662b4821d947fa5ec53df7019eaea310c3ae03e786dc2af03910a392e852d9

SHA512
c18931f47a78fde383d906de3e1708a7eed5155db574178bc9d9bc9cd8610e8337badf3bbeb18c6475978da3295f4a7c612762eced24f4f21167911d6c2096cf

Download Submit
memory/624-132-0x00000000005C0000-0x00000000005E5000-memory.dmp

Filesize
148KB

Download
memory/624-133-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/624-135-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1936-134-0x0000000000000000-mapping.dmp

Download