a72b8ff2539b9eaf1025357d48054b577b501d36cf7b0d8bf397aa6c8d75a95e

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a72b8ff2539b9eaf1025357d48054b577b501d36cf7b0d8bf397aa6c8d75a95e.exe
Size

1.8MB
MD5

eac972d2e7cbfc6796e2391a6d440bbf
SHA1

8f5d6bd771505eab8ad3da00a7ea331fe0c858d2
SHA256

a72b8ff2539b9eaf1025357d48054b577b501d36cf7b0d8bf397aa6c8d75a95e
SHA512

652e9ed13151e24d00c72bc823c5a47d6302b79d35acb23c1f8e21c9a5de11245a208b228f4c0574f4ad4ddf4e55ea64a9a85490a745bcf3ab44cbda386c692e
SSDEEP

49152:zunj2Ut4IKg77uIx4RE6w3KCvu4dgVXemo55i:zKj2Ut4IKg7aIe/w3luUr0

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	a72b8ff2539b9eaf1025357d48054b577b501d36cf7b0d8bf397aa6c8d75a95e.exe

Loads dropped DLL 2 IoCs

pid	Process
2584	msiexec.exe
2584	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2584	4880	a72b8ff2539b9eaf1025357d48054b577b501d36cf7b0d8bf397aa6c8d75a95e.exe	81
PID 4880 wrote to memory of 2584	4880	a72b8ff2539b9eaf1025357d48054b577b501d36cf7b0d8bf397aa6c8d75a95e.exe	81
PID 4880 wrote to memory of 2584	4880	a72b8ff2539b9eaf1025357d48054b577b501d36cf7b0d8bf397aa6c8d75a95e.exe	81

C:\Users\Admin\AppData\Local\Temp\a72b8ff2539b9eaf1025357d48054b577b501d36cf7b0d8bf397aa6c8d75a95e.exe
"C:\Users\Admin\AppData\Local\Temp\a72b8ff2539b9eaf1025357d48054b577b501d36cf7b0d8bf397aa6c8d75a95e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /y .\MhA86K.IS2
  2⤵
  - Loads dropped DLL
  PID:2584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MhA86K.IS2

Filesize
1.7MB

MD5
ef3dee9ab6e3eed4950a697689934509

SHA1
1c4a260864a061cf3ba733cf691af7f33972a7c6

SHA256
6275e55ed530baed8a868587a96b9136f0248101daae29a030e99dbc80d38c18

SHA512
535a6e77febae2dd00f663fe71c7fad3e87fb6e018743ae15f7b25bd3448d1dfcf146fdfadcd07366d75e65e3d6922382cc649478cd83bfd8019661159ed7421

Download Submit
C:\Users\Admin\AppData\Local\Temp\mhA86K.iS2

Filesize
1.7MB

MD5
ef3dee9ab6e3eed4950a697689934509

SHA1
1c4a260864a061cf3ba733cf691af7f33972a7c6

SHA256
6275e55ed530baed8a868587a96b9136f0248101daae29a030e99dbc80d38c18

SHA512
535a6e77febae2dd00f663fe71c7fad3e87fb6e018743ae15f7b25bd3448d1dfcf146fdfadcd07366d75e65e3d6922382cc649478cd83bfd8019661159ed7421

Download Submit
C:\Users\Admin\AppData\Local\Temp\mhA86K.iS2

Filesize
1.7MB

MD5
ef3dee9ab6e3eed4950a697689934509

SHA1
1c4a260864a061cf3ba733cf691af7f33972a7c6

SHA256
6275e55ed530baed8a868587a96b9136f0248101daae29a030e99dbc80d38c18

SHA512
535a6e77febae2dd00f663fe71c7fad3e87fb6e018743ae15f7b25bd3448d1dfcf146fdfadcd07366d75e65e3d6922382cc649478cd83bfd8019661159ed7421

Download Submit
memory/2584-136-0x00000000023E0000-0x00000000025A4000-memory.dmp

Filesize
1.8MB

Download