a2ddf5e7abe6e49fd63241335f203607005d6f224b6c43b92bd320cf8bd9181c

Analysis

max time kernel
327s
max time network
377s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a2ddf5e7abe6e49fd63241335f203607005d6f224b6c43b92bd320cf8bd9181c.exe
Size

76KB
MD5

7be2f5fa4830de9f0f219c8505966ef5
SHA1

081a32190d3ecbdefab1de8b6369d1cded0873ba
SHA256

a2ddf5e7abe6e49fd63241335f203607005d6f224b6c43b92bd320cf8bd9181c
SHA512

74244699a5d3dca58d639675794b432179db581986bfb332f330137f8db3655abeb0fe7cc8a5a54eefe1fe5aaebd3143e1867b78d82334478f042cd09fb5f75b
SSDEEP

1536:/nd47nXPeFCi0Jn+mIeTs3xEXf6/Dj6r/q97vKux7N+bpAn1gAL:fdk9Q8sSv6D2rCvXx5+beL

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	a2ddf5e7abe6e49fd63241335f203607005d6f224b6c43b92bd320cf8bd9181c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3012	3540	a2ddf5e7abe6e49fd63241335f203607005d6f224b6c43b92bd320cf8bd9181c.exe	81
PID 3540 wrote to memory of 3012	3540	a2ddf5e7abe6e49fd63241335f203607005d6f224b6c43b92bd320cf8bd9181c.exe	81
PID 3540 wrote to memory of 3012	3540	a2ddf5e7abe6e49fd63241335f203607005d6f224b6c43b92bd320cf8bd9181c.exe	81

C:\Users\Admin\AppData\Local\Temp\a2ddf5e7abe6e49fd63241335f203607005d6f224b6c43b92bd320cf8bd9181c.exe
"C:\Users\Admin\AppData\Local\Temp\a2ddf5e7abe6e49fd63241335f203607005d6f224b6c43b92bd320cf8bd9181c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Rnz..bat" > nul 2> nul
  2⤵
  PID:3012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Rnz..bat

Filesize
274B

MD5
e3cdf919721174f3ab8dbf8dd3e87dd1

SHA1
1af149dced4d21fb5166aef29920581f9710c44a

SHA256
0b431ccaf603b7ad4d5755751a371d3e1bdae1beef2cda834c9fd7c0889a8269

SHA512
d3e7fedd4f6bf168b336d8451df0bb36ad6cca3befaa59d94f5295e955a7b25f40d2155e7fed40c6ea78cba3b8123a04aa1b7a2fdc544fcbc35dfc2934a87142

Download Submit
memory/3540-132-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3540-133-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3540-134-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3540-136-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download