3bfaac1e5a664b4bbad05bf269ea8c88fe311565efd3b950c6ea9ac757433474

Analysis

max time kernel
145s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3bfaac1e5a664b4bbad05bf269ea8c88fe311565efd3b950c6ea9ac757433474.exe
Size

160KB
MD5

43fb31351f3f9d05442b7e85349cb11b
SHA1

0fb4df8b0227bc8712ad75ee96f168e517ea20e4
SHA256

3bfaac1e5a664b4bbad05bf269ea8c88fe311565efd3b950c6ea9ac757433474
SHA512

3882579f70e7300b3d3fec3ebeb223016e43b6112ae89a61e2c824516b44e16221872df9d68c9ab8723cc943ca2b51f425d2f3ab6763e1a3523ac24e3cde4964
SSDEEP

3072:8sDV6Az1wWgFvYGnJd6KpZV3uTN9WU/G9h3Gw590KqkbmzALbvl6:tQArgFvYGJd6KpZV3uTN9WU/G9h2w59X

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	3bfaac1e5a664b4bbad05bf269ea8c88fe311565efd3b950c6ea9ac757433474.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3bfaac1e5a664b4bbad05bf269ea8c88fe311565efd3b950c6ea9ac757433474.exe
"C:\Users\Admin\AppData\Local\Temp\3bfaac1e5a664b4bbad05bf269ea8c88fe311565efd3b950c6ea9ac757433474.exe"
1⤵
- Checks computer location settings
PID:4288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4288-132-0x00007FFD7C670000-0x00007FFD7D0A6000-memory.dmp

Filesize
10.2MB

Download