6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35

Analysis

max time kernel
137s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 05:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe
Size

103KB
MD5

11ced296cd64d3186ff10eb42f2197ed
SHA1

1407bdcf54f61486f974f17169ff796a6b259780
SHA256

6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35
SHA512

eab5726a9cbe2294bb578186d330ca0946163b3ad378110a3481c50fc3a1231482a03e419853be48fe736c6400df4dd90771aa38856889b44923a71aa6f5925d
SSDEEP

1536:CqJW3IBqpAXmqmuyBXSu6omC/w539lGzNP5x2d5shA73Y:dJW38/4EdVGNxxjhALY

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 4120	2584	6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe	80
PID 2584 wrote to memory of 4120	2584	6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe	80
PID 2584 wrote to memory of 4120	2584	6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe	80

C:\Users\Admin\AppData\Local\Temp\6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe
"C:\Users\Admin\AppData\Local\Temp\6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Shj..bat" > nul 2> nul
  2⤵
  PID:4120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Shj..bat

Filesize
274B

MD5
b2ce93421db03aebe2675fa21d6a7e2e

SHA1
029b7e2ce73deecc94b68bd4093b56439cd38f72

SHA256
4e2676970bbaf6399455c684f5b0a3f43259fd2af1025432c7b2c9b61819da97

SHA512
17776fcf16347e0d14421762e6d823681e6e5b48e01ccadfe4563df8d3540b8bcb94e7ed58f93c22c93644b5441058ba726099f8d7cba23818d6cbc4a2e038a4

Download Submit
memory/2584-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2584-133-0x0000000000401000-0x0000000000409000-memory.dmp

Filesize
32KB

Download
memory/2584-134-0x00000000009B0000-0x00000000009B9000-memory.dmp

Filesize
36KB

Download
memory/2584-135-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2584-137-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download