e95fcfa05c734769b9f72768fff58c7a5c8728428a1bef26f757b73fd2587ccd

Analysis

max time kernel
167s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e95fcfa05c734769b9f72768fff58c7a5c8728428a1bef26f757b73fd2587ccd.exe
Size

19KB
MD5

99b77d24379eb1299ea585f5a58c702a
SHA1

4cdbbde9691b1696715d95cb3afec5c5aa30743b
SHA256

e95fcfa05c734769b9f72768fff58c7a5c8728428a1bef26f757b73fd2587ccd
SHA512

7066721404704f373b05ac5978e6e69f80f2fee68406f923e6c16c799118f08c666a8cfab199b00bfa8e5646525ee0c44dd86e66c67b4be838c4a96f757e58c1
SSDEEP

384:uV723lkaZMCtDHh1ujHXRrs905INeZCFtejlIko5dN127BFVn2p4lAnZ8Ox8B+tY:cpaPBfujHXRrs9sINeZEtejlIkoLN12r

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1892	trueupdater.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	e95fcfa05c734769b9f72768fff58c7a5c8728428a1bef26f757b73fd2587ccd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1892	1688	e95fcfa05c734769b9f72768fff58c7a5c8728428a1bef26f757b73fd2587ccd.exe	81
PID 1688 wrote to memory of 1892	1688	e95fcfa05c734769b9f72768fff58c7a5c8728428a1bef26f757b73fd2587ccd.exe	81
PID 1688 wrote to memory of 1892	1688	e95fcfa05c734769b9f72768fff58c7a5c8728428a1bef26f757b73fd2587ccd.exe	81

C:\Users\Admin\AppData\Local\Temp\e95fcfa05c734769b9f72768fff58c7a5c8728428a1bef26f757b73fd2587ccd.exe
"C:\Users\Admin\AppData\Local\Temp\e95fcfa05c734769b9f72768fff58c7a5c8728428a1bef26f757b73fd2587ccd.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\trueupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"
  2⤵
  - Executes dropped EXE
  PID:1892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\trueupdater.exe

Filesize
19KB

MD5
457801ed2b93e796cfa186bc438093f7

SHA1
70134accf65e4153a8d3fe003879e3798b54892d

SHA256
e4ba42d0f6bb36659fbabff62ffeea3d41b5df462eb7309926ba81992897ef86

SHA512
2eddc4cd2096d6564ab430b5f7d25d595aec4922c60aba7bd3113c52eb5e40d80bd79345aa41a88714e378ebbe8b0e63ffb8c2f9d35f5f0cc66c6f1407a9b825

Download Submit
C:\Users\Admin\AppData\Local\Temp\trueupdater.exe

Filesize
19KB

MD5
457801ed2b93e796cfa186bc438093f7

SHA1
70134accf65e4153a8d3fe003879e3798b54892d

SHA256
e4ba42d0f6bb36659fbabff62ffeea3d41b5df462eb7309926ba81992897ef86

SHA512
2eddc4cd2096d6564ab430b5f7d25d595aec4922c60aba7bd3113c52eb5e40d80bd79345aa41a88714e378ebbe8b0e63ffb8c2f9d35f5f0cc66c6f1407a9b825

Download Submit
memory/1688-132-0x00000000009A0000-0x00000000009A9000-memory.dmp

Filesize
36KB

Download
memory/1892-136-0x0000000000A50000-0x0000000000A59000-memory.dmp

Filesize
36KB

Download