Analysis
-
max time kernel
95s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 04:24
Static task
static1
Behavioral task
behavioral1
Sample
f8474ae06bbc38cf1b43a8d89fd60a365ae0cd90deb855238b80869da5b8330d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f8474ae06bbc38cf1b43a8d89fd60a365ae0cd90deb855238b80869da5b8330d.exe
Resource
win10v2004-20220812-en
General
-
Target
f8474ae06bbc38cf1b43a8d89fd60a365ae0cd90deb855238b80869da5b8330d.exe
-
Size
744KB
-
MD5
637439447728fa93b5ccebf06ee7fbe0
-
SHA1
59890adad61cd019ce2018329c9dc11357c98d24
-
SHA256
f8474ae06bbc38cf1b43a8d89fd60a365ae0cd90deb855238b80869da5b8330d
-
SHA512
76038d47eab7d15df21669c9ca2d798e54d0fe1617f64b6b7fbada700a4212de4a01827b1fe99659ca9565797b230389217c7226b716899ede37f262d3a53b99
-
SSDEEP
12288:3vu1UZYHJcHBn6ECg7swsXGDunLYGGOFhMfkWoZL9Yi5ArURTophnjW2aTiVGt6I:FZMa593suqnLrG8hvWo1rjRyITiY0elT
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f8474ae06bbc38cf1b43a8d89fd60a365ae0cd90deb855238b80869da5b8330d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation f8474ae06bbc38cf1b43a8d89fd60a365ae0cd90deb855238b80869da5b8330d.exe -
Drops startup file 1 IoCs
Processes:
f8474ae06bbc38cf1b43a8d89fd60a365ae0cd90deb855238b80869da5b8330d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VWX7X6FE.exe f8474ae06bbc38cf1b43a8d89fd60a365ae0cd90deb855238b80869da5b8330d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3996-132-0x00007FFBC73C0000-0x00007FFBC7DF6000-memory.dmpFilesize
10.2MB