2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12

Analysis

max time kernel
325s
max time network
334s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12.exe
Size

926KB
MD5

60c7692389ad61eaafba95c1bec088f6
SHA1

06262a6155fc81aebbe4ce92a123eda90e1d3b68
SHA256

2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12
SHA512

05da400f8b7c007a94e8787717271889ca905b2834770ffdeaedb7e2cf251141f3b4446f27be3b49804c90072b7fe628f3fe8550759e9adeb1677c6274aca0dd
SSDEEP

12288:xtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgak7rL28Gal16A:xtb20pkaCqT5TBWgNQ7asPI216A

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

winrt.exe

pid process

4612 winrt.exe

pid	process
4612	winrt.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\winrt.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\winrt.exe	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12.exe

description	pid	process	target process
PID 2788 wrote to memory of 4612	2788	2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12.exe	winrt.exe
PID 2788 wrote to memory of 4612	2788	2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12.exe	winrt.exe
PID 2788 wrote to memory of 4612	2788	2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12.exe	winrt.exe

C:\Users\Admin\AppData\Local\Temp\2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12.exe
"C:\Users\Admin\AppData\Local\Temp\2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2788

C:\Users\Admin\AppData\Roaming\winrt.exe
"C:\Users\Admin\AppData\Roaming\winrt.exe"
2⤵
- Executes dropped EXE
PID:4612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\winrt.exe
Filesize
926KB

MD5
60c7692389ad61eaafba95c1bec088f6

SHA1
06262a6155fc81aebbe4ce92a123eda90e1d3b68

SHA256
2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12

SHA512
05da400f8b7c007a94e8787717271889ca905b2834770ffdeaedb7e2cf251141f3b4446f27be3b49804c90072b7fe628f3fe8550759e9adeb1677c6274aca0dd

Download Submit
C:\Users\Admin\AppData\Roaming\winrt.exe
Filesize
926KB

MD5
60c7692389ad61eaafba95c1bec088f6

SHA1
06262a6155fc81aebbe4ce92a123eda90e1d3b68

SHA256
2695946f21260256746ea43cdc8602768973cda58a45c0795fe251623962bf12

SHA512
05da400f8b7c007a94e8787717271889ca905b2834770ffdeaedb7e2cf251141f3b4446f27be3b49804c90072b7fe628f3fe8550759e9adeb1677c6274aca0dd

Download Submit
memory/4612-132-0x0000000000000000-mapping.dmp

Download