9ff4cef092fabac7201c04fa47518adeed847a9389fe6cb6e1e0c3c7f4cb52bb

Analysis

max time kernel
148s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ff4cef092fabac7201c04fa47518adeed847a9389fe6cb6e1e0c3c7f4cb52bb.exe
Size

195KB
MD5

bb073ce32d59a9d899a52ce2754f2735
SHA1

61d3f7cb343814202111537c687290e89df347df
SHA256

9ff4cef092fabac7201c04fa47518adeed847a9389fe6cb6e1e0c3c7f4cb52bb
SHA512

82c7b54dd948f5a2934338683f7d8caa82ab910b0be1727952ad3c5e2ca9bc7273d7ee1cf49cd00a25a61b19165d156360d90cc04d598dfd9f5034cfb2a40fe6
SSDEEP

6144:sT/NkXkB4X8zYEovPRrmUmQ0yj169bOurwzKjrLIIYuM:I10kBI8I3RzkjrL+

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
712	6.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	9ff4cef092fabac7201c04fa47518adeed847a9389fe6cb6e1e0c3c7f4cb52bb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 712	4532	9ff4cef092fabac7201c04fa47518adeed847a9389fe6cb6e1e0c3c7f4cb52bb.exe	87
PID 4532 wrote to memory of 712	4532	9ff4cef092fabac7201c04fa47518adeed847a9389fe6cb6e1e0c3c7f4cb52bb.exe	87
PID 4532 wrote to memory of 712	4532	9ff4cef092fabac7201c04fa47518adeed847a9389fe6cb6e1e0c3c7f4cb52bb.exe	87
PID 712 wrote to memory of 4552	712	6.exe	93
PID 712 wrote to memory of 4552	712	6.exe	93
PID 712 wrote to memory of 4552	712	6.exe	93

C:\Users\Admin\AppData\Local\Temp\9ff4cef092fabac7201c04fa47518adeed847a9389fe6cb6e1e0c3c7f4cb52bb.exe
"C:\Users\Admin\AppData\Local\Temp\9ff4cef092fabac7201c04fa47518adeed847a9389fe6cb6e1e0c3c7f4cb52bb.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\6.exe
  "C:\Users\Admin\AppData\Local\Temp\6.exe" "C:\Users\Admin\AppData\Local\Temp\9ff4cef092fabac7201c04fa47518adeed847a9389fe6cb6e1e0c3c7f4cb52bb.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\19402.bat" "C:\Users\Admin\AppData\Local\Temp\6.exe""
    3⤵
    PID:4552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\19402.bat

Filesize
205B

MD5
af942e21a17f04903c52cb28a9b89542

SHA1
ebcfe47bad384564346db4141d26e3e68f9f984f

SHA256
c62a90b84dac61f74122f6eaa01665155a18b28a68b799a963f8a877194f922d

SHA512
790decec1485e8fc42c3ee09a3e871ee95fdf2bf2e5f15556de0a5b5db2106114d79206acf2dcf3e7c0dbe9df7b1298e0b3f7247a34d9d3bd9f296cc9b61211a

Download Submit
C:\Users\Admin\AppData\Local\Temp\6.exe

Filesize
193KB

MD5
8a49ee25fcfa51d96339b3ba67d35cbd

SHA1
1dae2ad6262b0607292ede227b41de088b49b4bf

SHA256
52ab5848a823605994f225e0f96d78bd244928b9da0c5aaac11e6881a98fcd39

SHA512
f8827d523a16a39fd3190c55ea1b20d0065c664372271b313915045661dc38bfe1eee9abc7a44fb10311a9e5e2ca3d6f3de66d90171fde0a68d7019afad3d37c

Download Submit
C:\Users\Admin\AppData\Local\Temp\6.exe

Filesize
193KB

MD5
8a49ee25fcfa51d96339b3ba67d35cbd

SHA1
1dae2ad6262b0607292ede227b41de088b49b4bf

SHA256
52ab5848a823605994f225e0f96d78bd244928b9da0c5aaac11e6881a98fcd39

SHA512
f8827d523a16a39fd3190c55ea1b20d0065c664372271b313915045661dc38bfe1eee9abc7a44fb10311a9e5e2ca3d6f3de66d90171fde0a68d7019afad3d37c

Download Submit