0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666

Analysis

max time kernel
146s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666.exe
Size

191KB
MD5

6f204ac7e40d82963c7c1a1449acfea2
SHA1

36ab86149523ecd1dd6210285de9777c24ab3708
SHA256

0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666
SHA512

efacc891f4af15024af7127dc60b2907468bfc0cec6fbbf14505bb908bb987031c475e1d61447b451035650229b4172ebf3489f6bd786c7512b073e2dd10c14d
SSDEEP

3072:jiDZW9tCFUkd8nS5JTEc5f/xk9T+bcngp2h7XRNKhBlw/3f/gbAi3:jiI9thk2S5P5f/xk9T+wngcVeBIH8Ai

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4904	Trojan.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	Trojan.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	Trojan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4904	3496	0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666.exe	85
PID 3496 wrote to memory of 4904	3496	0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666.exe	85
PID 3496 wrote to memory of 4904	3496	0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666.exe	85

C:\Users\Admin\AppData\Local\Temp\0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666.exe
"C:\Users\Admin\AppData\Local\Temp\0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Users\Admin\AppData\Local\Temp\Trojan.exe
  "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trojan.exe

Filesize
191KB

MD5
6f204ac7e40d82963c7c1a1449acfea2

SHA1
36ab86149523ecd1dd6210285de9777c24ab3708

SHA256
0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666

SHA512
efacc891f4af15024af7127dc60b2907468bfc0cec6fbbf14505bb908bb987031c475e1d61447b451035650229b4172ebf3489f6bd786c7512b073e2dd10c14d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe

Filesize
191KB

MD5
6f204ac7e40d82963c7c1a1449acfea2

SHA1
36ab86149523ecd1dd6210285de9777c24ab3708

SHA256
0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666

SHA512
efacc891f4af15024af7127dc60b2907468bfc0cec6fbbf14505bb908bb987031c475e1d61447b451035650229b4172ebf3489f6bd786c7512b073e2dd10c14d

Download Submit
memory/3496-132-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/3496-138-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/4904-136-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/4904-137-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download