f9e2c79659921f4f0fa54e6d6d960f8e83c61577c2d0601ab2d56c65879b323f

Analysis

max time kernel
136s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9e2c79659921f4f0fa54e6d6d960f8e83c61577c2d0601ab2d56c65879b323f.exe
Size

911KB
MD5

00ca2f10a413071f98f66b830aa9fe88
SHA1

1d86fe0eb3d328221eb1a822f2ee825e78f5c520
SHA256

f9e2c79659921f4f0fa54e6d6d960f8e83c61577c2d0601ab2d56c65879b323f
SHA512

31cf5e4dabd966ead74a2e47d7307f0c88af25c58ec27118a67e73823d4f53abca9c98a74f7a708d30eb65352115990226d2c4a38a7f3d886e4cfa7780c6f2f4
SSDEEP

12288:+K2mhAMJ/cPlhTrT58h7UZ6+5d2J/R+OOWy2PSQQhcuchCpjAHIC:v2O/GlRrK7nJQ5WRPuCXCdTC

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	f9e2c79659921f4f0fa54e6d6d960f8e83c61577c2d0601ab2d56c65879b323f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\f9e2c79659921f4f0fa54e6d6d960f8e83c61577c2d0601ab2d56c65879b323f.exe
"C:\Users\Admin\AppData\Local\Temp\f9e2c79659921f4f0fa54e6d6d960f8e83c61577c2d0601ab2d56c65879b323f.exe"
1⤵
- Checks computer location settings
PID:4512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...