72f0fa8c053fab90a43ed18ff5bb962de6d31f13b7dc7fb078afb0ba1ded4722

Analysis

max time kernel
181s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72f0fa8c053fab90a43ed18ff5bb962de6d31f13b7dc7fb078afb0ba1ded4722.exe
Size

19KB
MD5

2580ddd3beb3924654a9f9aec9e195a0
SHA1

29e21919ef0b77d2071eadd75ee6ad80e596cf61
SHA256

72f0fa8c053fab90a43ed18ff5bb962de6d31f13b7dc7fb078afb0ba1ded4722
SHA512

f388a96ca43dc3627a2400a5725308afe18aa581ba889bb9f6624a90a65978807accf5d136bf4734ae724b167dc18a6dc00df4bb4c7d9e174fd0cb9efa25d8ed
SSDEEP

192:n3GXehQZMKauy7RoZotti+dQf6Tyu1oynlEwbJZ/kq0Fn2EN2eby:n3ThQCI0RoEFTL1ftbGFHN2p

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

suzrh.exe

pid process

3496 suzrh.exe

pid	process
3496	suzrh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

72f0fa8c053fab90a43ed18ff5bb962de6d31f13b7dc7fb078afb0ba1ded4722.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	72f0fa8c053fab90a43ed18ff5bb962de6d31f13b7dc7fb078afb0ba1ded4722.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

72f0fa8c053fab90a43ed18ff5bb962de6d31f13b7dc7fb078afb0ba1ded4722.exe

description	pid	process	target process
PID 1224 wrote to memory of 3496	1224	72f0fa8c053fab90a43ed18ff5bb962de6d31f13b7dc7fb078afb0ba1ded4722.exe	suzrh.exe
PID 1224 wrote to memory of 3496	1224	72f0fa8c053fab90a43ed18ff5bb962de6d31f13b7dc7fb078afb0ba1ded4722.exe	suzrh.exe
PID 1224 wrote to memory of 3496	1224	72f0fa8c053fab90a43ed18ff5bb962de6d31f13b7dc7fb078afb0ba1ded4722.exe	suzrh.exe

C:\Users\Admin\AppData\Local\Temp\72f0fa8c053fab90a43ed18ff5bb962de6d31f13b7dc7fb078afb0ba1ded4722.exe
"C:\Users\Admin\AppData\Local\Temp\72f0fa8c053fab90a43ed18ff5bb962de6d31f13b7dc7fb078afb0ba1ded4722.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\suzrh.exe
"C:\Users\Admin\AppData\Local\Temp\suzrh.exe"
2⤵
- Executes dropped EXE
PID:3496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\suzrh.exe
Filesize
19KB

MD5
032925ad3ee15add1c3b02ad2f42aab9

SHA1
23afbf3244f217a8f88fa712ddc6c23f5de9e723

SHA256
4cef16cdb06912210be9e58cc0c62f521c53c6f06b9e3e935ab029e413df8c24

SHA512
bd391ae978556e7925302efc9d14575170765fa75e81d08eb720ff01ab404ca61207552cdfe5a981768458f16b269528d9e0d6e356f52703e66375e727bc25ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\suzrh.exe
Filesize
19KB

MD5
032925ad3ee15add1c3b02ad2f42aab9

SHA1
23afbf3244f217a8f88fa712ddc6c23f5de9e723

SHA256
4cef16cdb06912210be9e58cc0c62f521c53c6f06b9e3e935ab029e413df8c24

SHA512
bd391ae978556e7925302efc9d14575170765fa75e81d08eb720ff01ab404ca61207552cdfe5a981768458f16b269528d9e0d6e356f52703e66375e727bc25ff

Download Submit
memory/1224-132-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3496-133-0x0000000000000000-mapping.dmp

Download
memory/3496-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download