bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b

Analysis

max time kernel
354s
max time network
392s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe
Size

1.3MB
MD5

e0b35ac78daa38069316b665be0ccaf4
SHA1

32eed5fcd7957abd63f5df6ecd6b5328d81139f4
SHA256

bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b
SHA512

356e865b56a7e1a147c4bee0f9753f1084e2cfd5ca957abc34f784587d254288bb4063b77bce3fbfdf9a0959ffc54cbc8b4fee96b11c22049b5a401b12fcd6fe
SSDEEP

24576:b1dlZo5xdydAwqnT7yW7a6xLfi+VjkPLGC0PYo+L6L8o8BBd2RVeIUTCvSxZE:b1dlZoryOvyW26xLfi+mqCU+23SPTOvV

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

b00t.exe

pid process

4660 b00t.exe

pid	process
4660	b00t.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

b00t.exe

description ioc process

Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b00t.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b00t.exe

Drops file in Windows directory 3 IoCs

Processes:

bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe

description	ioc	process
File created	C:\Windows\b00t.exe	bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe
File opened for modification	C:\Windows\Åí™ÇÌs–hÒ¿{k@%\|êú÷ÌÓyA{Ì² :FÍ” öŠ[0íB—!.5¶Ëz0àPJ=â·®XXøû E~ëW÷iÉcDõ×öË>.ANkmžÔ]83ôÝø+]?cÝã¨M	bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe
File created	C:\Windows\YmFlood3update.rar	bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

Processes:

bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe

description	ioc	process
File opened for modification	C:\Windows\Åí™ÇÌs–hÒ¿{k@%\|êú÷ÌÓyA{Ì² :FÍ” öŠ[0íB—!.5¶Ëz0àPJ=â·®XXøû E~ëW÷iÉcDõ×öË>.ANkmžÔ]83ôÝø+]?cÝã¨M	bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe

description	pid	process	target process
PID 4536 wrote to memory of 4660	4536	bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe	b00t.exe
PID 4536 wrote to memory of 4660	4536	bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe	b00t.exe
PID 4536 wrote to memory of 4660	4536	bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe	b00t.exe

C:\Users\Admin\AppData\Local\Temp\bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe
"C:\Users\Admin\AppData\Local\Temp\bb059eacc6763d5cee9de8eb6fac2054488d31a1e58c264ce5c5146775e11c6b.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4536

C:\Windows\b00t.exe
"C:\Windows\b00t.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\b00t.exe
Filesize
1.2MB

MD5
51b548239d90584260276520c4093a25

SHA1
96eb881da42da570319a96aec3ac30be6825997e

SHA256
b83764fb37b133525e94ab5d520f814f137f2da359f8853c0feb62fb0d5a0a70

SHA512
fa5ea1fe93482b95cdf6fee6ce117a1a91bf087dbe649048058ecfae13af5631a8ce41535ee8c56827e69b26dbe74b2168a7fdc4dc8b59b5648e0f98d0bce55d

Download Submit
C:\Windows\b00t.exe
Filesize
1.2MB

MD5
51b548239d90584260276520c4093a25

SHA1
96eb881da42da570319a96aec3ac30be6825997e

SHA256
b83764fb37b133525e94ab5d520f814f137f2da359f8853c0feb62fb0d5a0a70

SHA512
fa5ea1fe93482b95cdf6fee6ce117a1a91bf087dbe649048058ecfae13af5631a8ce41535ee8c56827e69b26dbe74b2168a7fdc4dc8b59b5648e0f98d0bce55d

Download Submit
memory/4660-132-0x0000000000000000-mapping.dmp

Download