9b933a187145cfed4a45c26485014ab788e24015862ef9beb123d4662667260a

Analysis

max time kernel
185s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b933a187145cfed4a45c26485014ab788e24015862ef9beb123d4662667260a.exe
Size

23KB
MD5

897ee77406d2e7609470d0245c19fbd8
SHA1

6788ec56382b59a4986c558d5ff0881e388403da
SHA256

9b933a187145cfed4a45c26485014ab788e24015862ef9beb123d4662667260a
SHA512

f31c79963886f9d3633ac1a1d0e846c69bf977e3890549355a46c59fd17249925899dfa2885fcecfa5bb231e634e1492a92feead76b5e60338edd938fb7c44a6
SSDEEP

384:YfkmoEDs5T5x5e5U59KxJJ5RRT5gMMr/WX1Ka/YFy1ZraLk24jXPl6a3XEWE5yYE:Vm7A5T5x5e5U59KxJJ5RRT5gMMaFfgYL

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3552	system.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	9b933a187145cfed4a45c26485014ab788e24015862ef9beb123d4662667260a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	system.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	system.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 3552	1184	9b933a187145cfed4a45c26485014ab788e24015862ef9beb123d4662667260a.exe	84
PID 1184 wrote to memory of 3552	1184	9b933a187145cfed4a45c26485014ab788e24015862ef9beb123d4662667260a.exe	84
PID 1184 wrote to memory of 3552	1184	9b933a187145cfed4a45c26485014ab788e24015862ef9beb123d4662667260a.exe	84

C:\Users\Admin\AppData\Local\Temp\9b933a187145cfed4a45c26485014ab788e24015862ef9beb123d4662667260a.exe
"C:\Users\Admin\AppData\Local\Temp\9b933a187145cfed4a45c26485014ab788e24015862ef9beb123d4662667260a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\system.exe
  "C:\Users\Admin\AppData\Local\Temp\system.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\system.exe

Filesize
23KB

MD5
897ee77406d2e7609470d0245c19fbd8

SHA1
6788ec56382b59a4986c558d5ff0881e388403da

SHA256
9b933a187145cfed4a45c26485014ab788e24015862ef9beb123d4662667260a

SHA512
f31c79963886f9d3633ac1a1d0e846c69bf977e3890549355a46c59fd17249925899dfa2885fcecfa5bb231e634e1492a92feead76b5e60338edd938fb7c44a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\system.exe

Filesize
23KB

MD5
897ee77406d2e7609470d0245c19fbd8

SHA1
6788ec56382b59a4986c558d5ff0881e388403da

SHA256
9b933a187145cfed4a45c26485014ab788e24015862ef9beb123d4662667260a

SHA512
f31c79963886f9d3633ac1a1d0e846c69bf977e3890549355a46c59fd17249925899dfa2885fcecfa5bb231e634e1492a92feead76b5e60338edd938fb7c44a6

Download Submit
memory/1184-132-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/1184-133-0x0000000004A50000-0x0000000004AEC000-memory.dmp

Filesize
624KB

Download
memory/1184-134-0x00000000050A0000-0x0000000005644000-memory.dmp

Filesize
5.6MB

Download
memory/1184-135-0x0000000004B90000-0x0000000004C22000-memory.dmp

Filesize
584KB

Download
memory/1184-136-0x0000000004B10000-0x0000000004B1A000-memory.dmp

Filesize
40KB

Download
memory/1184-137-0x0000000004DB0000-0x0000000004E06000-memory.dmp

Filesize
344KB

Download