cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f

Analysis

max time kernel
180s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe
Size

98KB
MD5

c57d425e738f3fddeb94c5de80feef76
SHA1

64225aa92a7a6afd217a5ae81fb04ffe338ef24e
SHA256

cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f
SHA512

add240f3af69809e0e977726d64635feaa9316bdcd77c2a2136db2cc20617aeae29b26dd59c01584efa71c65a849ce5c547d393f54e0e1ec04d9fd984a03e715
SSDEEP

1536:Fv5MASDL6vr9s8hPBArSj74ckzblHY0kWloZLtnckP390q+3/k5159:FvkgS8h+r84pG06oq+M513

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe

Drops file in Windows directory 1 IoCs

Processes:

cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe

description ioc process

File opened for modification C:\Windows\sysWOW32 cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\sysWOW32	cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe

pid	process
4444	cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe
4444	cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe

description	pid	process	target process
PID 4444 wrote to memory of 2296	4444	cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe	cmd.exe
PID 4444 wrote to memory of 2296	4444	cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe
"C:\Users\Admin\AppData\Local\Temp\cf175f18c52a5ec80d98f3890aedb38cc7d98cba9433c50c79b6bd628e649a7f.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\killfile.bat" "
2⤵
PID:2296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\killfile.bat
Filesize
301B

MD5
8a16ff6ec591f35c2c51cc66e0bf5582

SHA1
816d4f8c76a6dfd3b500a8c9f5e354534b26aa8e

SHA256
bedf851dd4aa39031a04eb11b026f2a4c0038003c19d63a6d33d4a8d4f38c63b

SHA512
cff43991cc66e505d2daa1461abbc537a71f0e084190d9611f9cf23764fe0d822e2f93ac0246951ee3a16c5609da27706271a19b7c341a8de779a5ab68a089e4

Download Submit
memory/2296-135-0x0000000000000000-mapping.dmp

Download