aef03763d0e0c0bf33a1aa4f188b48cdd81bfb85a2d37a776be425e1327d3006

Analysis

max time kernel
189s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aef03763d0e0c0bf33a1aa4f188b48cdd81bfb85a2d37a776be425e1327d3006.exe
Size

5.1MB
MD5

35abab024ca4a32290e9a8a5c10dcfac
SHA1

14527f44f92b97f0e81059512eca71a99654edcc
SHA256

aef03763d0e0c0bf33a1aa4f188b48cdd81bfb85a2d37a776be425e1327d3006
SHA512

e326c447a9c8cd34487feaac6500c2974975946ddd8bd649a6da884a0b0103ca8b0db709b83fefd253369008ca2fc34a82713b087ce51ad4f1618da6c390e6ec
SSDEEP

98304:CqYB2QxGBQb7hxtX2uGoprvuwXKjGTXgMrWQDty0umspxl5UeCMXmssG:CgFBkhxtGKprvrzrbty0qxl5Usvz

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	aef03763d0e0c0bf33a1aa4f188b48cdd81bfb85a2d37a776be425e1327d3006.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	aef03763d0e0c0bf33a1aa4f188b48cdd81bfb85a2d37a776be425e1327d3006.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 396	1168	aef03763d0e0c0bf33a1aa4f188b48cdd81bfb85a2d37a776be425e1327d3006.exe	83
PID 1168 wrote to memory of 396	1168	aef03763d0e0c0bf33a1aa4f188b48cdd81bfb85a2d37a776be425e1327d3006.exe	83
PID 1168 wrote to memory of 396	1168	aef03763d0e0c0bf33a1aa4f188b48cdd81bfb85a2d37a776be425e1327d3006.exe	83

C:\Users\Admin\AppData\Local\Temp\aef03763d0e0c0bf33a1aa4f188b48cdd81bfb85a2d37a776be425e1327d3006.exe
"C:\Users\Admin\AppData\Local\Temp\aef03763d0e0c0bf33a1aa4f188b48cdd81bfb85a2d37a776be425e1327d3006.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\×Ô½âÑ¹ÎÄ¼þ\sm.txt
  2⤵
  PID:396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\×Ô½âÑ¹ÎÄ¼þ\sm.txt

Filesize
626B

MD5
2b711dc1468d44d0368d2766a94f31a8

SHA1
8ac2337a76633c1a86d26ad4a2214218531bd3de

SHA256
4dfc9c54cef75d7920f81181980446dde663ecfb605d6f618debe74311dc2944

SHA512
8a58dc7412c30c3434a9107e0b15018ac3ef631291d9ca2f76ff4e0c24b46405a2d26e76b8a9fca80de6440363ed228009dac9c26446584821a740ca667f098e

Download Submit