97b7fc87f5c54a3e82e3b84326cd3e58326105052ffe350aed256e657de9b3df

Analysis

max time kernel
230s
max time network
325s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97b7fc87f5c54a3e82e3b84326cd3e58326105052ffe350aed256e657de9b3df.exe
Size

830KB
MD5

cd1c69c960ab6f8328fc613ab2afd772
SHA1

441287882959b3569149676b743399b6268c7a5f
SHA256

97b7fc87f5c54a3e82e3b84326cd3e58326105052ffe350aed256e657de9b3df
SHA512

d6c9b2bc65e112108de6b47ed1f24ea8f5aeac114689ecb942169009dbbf2aa2911065a2aef2c643dc75108c80f439e4c9a4eabc9f47dff78d0348ab82c73b50
SSDEEP

12288:zat0EAH49n8BRM+gEEtoCkeUxhWkBJ0pTCaQfOgNgrX2gIvvsL/8T3eJGix:mt24+MICkeU5W+OSgLpz4T3eJGs

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

snqoi.cmd

pid process

3032 snqoi.cmd

pid	process
3032	snqoi.cmd

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

97b7fc87f5c54a3e82e3b84326cd3e58326105052ffe350aed256e657de9b3df.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	97b7fc87f5c54a3e82e3b84326cd3e58326105052ffe350aed256e657de9b3df.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

97b7fc87f5c54a3e82e3b84326cd3e58326105052ffe350aed256e657de9b3df.exe

description	pid	process	target process
PID 364 wrote to memory of 3032	364	97b7fc87f5c54a3e82e3b84326cd3e58326105052ffe350aed256e657de9b3df.exe	snqoi.cmd
PID 364 wrote to memory of 3032	364	97b7fc87f5c54a3e82e3b84326cd3e58326105052ffe350aed256e657de9b3df.exe	snqoi.cmd
PID 364 wrote to memory of 3032	364	97b7fc87f5c54a3e82e3b84326cd3e58326105052ffe350aed256e657de9b3df.exe	snqoi.cmd

C:\Users\Admin\AppData\Local\Temp\97b7fc87f5c54a3e82e3b84326cd3e58326105052ffe350aed256e657de9b3df.exe
"C:\Users\Admin\AppData\Local\Temp\97b7fc87f5c54a3e82e3b84326cd3e58326105052ffe350aed256e657de9b3df.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:364

C:\Users\Admin\AppData\Roaming\htjxu\snqoi.cmd
"C:\Users\Admin\AppData\Roaming\htjxu\snqoi.cmd" mpfcl.uxt
2⤵
- Executes dropped EXE
PID:3032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\htjxu\snqoi.cmd
Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Roaming\htjxu\snqoi.cmd
Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
memory/3032-132-0x0000000000000000-mapping.dmp

Download