663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585

Analysis

max time kernel
106s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe
Size

1.5MB
MD5

60b75ade92d0728daf0e1a3c10464d89
SHA1

d4f18df4f5b7aba16ffd86fe5156b0ebad91e60c
SHA256

663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585
SHA512

0d6d5bb2857369e2804719bfd38d7a1cb17501f760c80f5eb1da0339abe2b95abc74735154d50e5b3a74c23c8eefae5028af942c9b6232e800d30b9a5c56ad79
SSDEEP

24576:Hpa/O74CNt3r2J2FC3eUldZUJ3OlKU4UDcc6Cy+9eGx:wcZC35VcOcmDcc6Cdj

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 2128	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3468	PING.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2128	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe
2128	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe
2128	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe
2128	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe
2128	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2032	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	83
PID 2348 wrote to memory of 2032	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	83
PID 2348 wrote to memory of 2032	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	83
PID 2348 wrote to memory of 2128	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	85
PID 2348 wrote to memory of 2128	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	85
PID 2348 wrote to memory of 2128	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	85
PID 2348 wrote to memory of 2128	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	85
PID 2348 wrote to memory of 2128	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	85
PID 2348 wrote to memory of 2128	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	85
PID 2348 wrote to memory of 2128	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	85
PID 2348 wrote to memory of 2128	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	85
PID 2348 wrote to memory of 2128	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	85
PID 2348 wrote to memory of 2128	2348	663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe	85
PID 2032 wrote to memory of 3468	2032	cmd.exe	86
PID 2032 wrote to memory of 3468	2032	cmd.exe	86
PID 2032 wrote to memory of 3468	2032	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe
"C:\Users\Admin\AppData\Local\Temp\663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -c 5 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\PING.EXE
    ping -c 5 8.8.8.8
    3⤵
    - Runs ping.exe
    PID:3468
- C:\Users\Admin\AppData\Local\Temp\663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe
  "C:\Users\Admin\AppData\Local\Temp\663d9afc9b43110d027422d8f126ec5f9e3377b71a860b6de5206d43a3e4d585.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2128-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2128-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2128-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2128-139-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download