Analysis
-
max time kernel
186s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c.exe
Resource
win10v2004-20221111-en
General
-
Target
d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c.exe
-
Size
79KB
-
MD5
50656f12d52e27fdf8d0669635b9db8b
-
SHA1
5b4b3e3f0cc471b36de969f942d8dfb5305ade1d
-
SHA256
d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c
-
SHA512
510c19203652956bcd4132b3a6fb3bf095c8f584ddad298929b9852fbd0808f075571847bd62b10a8f9da6879bdb942ef3ac9d6466655d2d44f00e2a934582e6
-
SSDEEP
768:tOKkRrbAeAvnLPu5BEAUMkCf9xszmJSwO8I3eUZjwyDOJJb+QhyU9o:yRrbAeAvn7uyMd6wO8wPw+JL
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation d2dcc8e23d4adb3db16b19550fba8466850c1a04f1a44dcc2bfe6032c493031c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.