c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1

Analysis

max time kernel
190s
max time network
228s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 15:00

Target

c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1.exe
Size

99KB
MD5

2fcb4d8d1507dc2ff80479fa20ad62e3
SHA1

860a496c143d6a8af861e840a0529ed67c50921f
SHA256

c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1
SHA512

a86d68b8ff5f785c015de2cfa81abe9a995290432cbb010c9a0a33c9070a14454478202337a30cd25993ca2fa17c8a3c2fb985cb8113bec8aee962a3b10e4ede
SSDEEP

1536:GVkbZTBOd+bAwXrQd77D/5AMidg/7auaYvn56RDSCH5csnV319Q4Q5Vl+0:GeO+VdJl3Sy9Q55Vl+0

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sysWOW32	c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4904	c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1.exe
4904	c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1.exe
4904	c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1.exe
4904	c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 3124	4904	c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1.exe	83
PID 4904 wrote to memory of 3124	4904	c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1.exe	83

C:\Users\Admin\AppData\Local\Temp\c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1.exe
"C:\Users\Admin\AppData\Local\Temp\c80d11f366e6eca307011de8b69dee080830f955ccee8617873ba718b28baac1.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\killfile.bat" "
  2⤵
  PID:3124

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\killfile.bat

Filesize
301B

MD5
fe0e01e9723abb55105bb63f331fe5c5

SHA1
0b9f7c16388fd6dea42d5bb987cb18f323170c65

SHA256
550c70a5e0932e431a53303edeee59d3490e6dc07cd81ed2170d19a616d68563

SHA512
721a9808d828e3e203cc4783b11ae021445649e0b3df09cb81e1b4794e6d98c58e15d840b5eb8afd4fe6860d0b17c487386c65415379f606bb6e07b3863fe9ac

Download Submit