2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e

Analysis

max time kernel
155s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e.exe
Size

31KB
MD5

ec80afe8f4a385eca80ed4fba61389ac
SHA1

f29a1407cc0888adb26f6aae0653bf7b5b11630e
SHA256

2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e
SHA512

824f8900cbd3de147e1ca2aee7e293f53b020a9c9dc601f78f3233fa825761a6f85824c89003ab6e7904ab86408cb92a9d40258384c24195b2889eab3c9376d2
SSDEEP

384:bxVE4yJSHv/KrenwVvaIKMQg8otgJ4gPbbRnxjerJ8lNEzj1U:tFHv/ewyiNg8otgRSV8bSq

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 3228	3192	2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e.exe	85
PID 3192 wrote to memory of 3228	3192	2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e.exe	85

C:\Users\Admin\AppData\Local\Temp\2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e.exe
"C:\Users\Admin\AppData\Local\Temp\2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Users\Admin\AppData\Local\Temp\2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e.exe
  "C:\Users\Admin\AppData\Local\Temp\2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e.exe"
  2⤵
  PID:3228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\2ef485ba3916d42ad849df86aa17d26dae8d83b020496db113945868e44fe80e.exe.log

Filesize
680B

MD5
ad5aa0f8a0c88ea0d285ffb41fb8ea95

SHA1
36937c5f30da4d65e223ffee95fa445f5da55d26

SHA256
dc6701c2e677362098eb8ad275255b2e7f691c73355acf1f5485671ed3503729

SHA512
144a94f7daaae29ab912054a63e513b009b3836a97979597d66ba454f420efae6737d407e570b7bb204656a908988f67931c5a877401cc403037a7523c1a734e

Download Submit
memory/3192-132-0x00007FFBDA2E0000-0x00007FFBDAD16000-memory.dmp

Filesize
10.2MB

Download
memory/3228-135-0x00007FFBDA2E0000-0x00007FFBDAD16000-memory.dmp

Filesize
10.2MB

Download