83d13c355a33cca5e8a53a07b5bb4264ce89fc29123fbcb78d7c090cef66585a

Analysis

max time kernel
156s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83d13c355a33cca5e8a53a07b5bb4264ce89fc29123fbcb78d7c090cef66585a.exe
Size

67KB
MD5

51bf0f2b8b4fbac3b52fc3bbdf96ffb9
SHA1

92a39bb8a92a75996193bc6f07327fa5766c3488
SHA256

83d13c355a33cca5e8a53a07b5bb4264ce89fc29123fbcb78d7c090cef66585a
SHA512

ef4947e07d4979c08d2634f763501d02cb51876120cbfb814557f03d15cb05288c781c2738d09a15b8f5b87a77280e8215855f5484fb953ebe433727b6babc84
SSDEEP

1536:2wetP10SuUdZuhRfUwvw37j/XrTnEmgIFlkFVtJ/i:2vc0ZupIrj/XzD4d/i

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	83d13c355a33cca5e8a53a07b5bb4264ce89fc29123fbcb78d7c090cef66585a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4068	83d13c355a33cca5e8a53a07b5bb4264ce89fc29123fbcb78d7c090cef66585a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1524	4068	83d13c355a33cca5e8a53a07b5bb4264ce89fc29123fbcb78d7c090cef66585a.exe	81
PID 4068 wrote to memory of 1524	4068	83d13c355a33cca5e8a53a07b5bb4264ce89fc29123fbcb78d7c090cef66585a.exe	81
PID 4068 wrote to memory of 1524	4068	83d13c355a33cca5e8a53a07b5bb4264ce89fc29123fbcb78d7c090cef66585a.exe	81

C:\Users\Admin\AppData\Local\Temp\83d13c355a33cca5e8a53a07b5bb4264ce89fc29123fbcb78d7c090cef66585a.exe
"C:\Users\Admin\AppData\Local\Temp\83d13c355a33cca5e8a53a07b5bb4264ce89fc29123fbcb78d7c090cef66585a.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Zhv..bat" > nul 2> nul
  2⤵
  PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Zhv..bat

Filesize
274B

MD5
e74f745136250e69981fcce50e93ef13

SHA1
197f0d4f8a9fdaad391614e61ddfd076e58a1ca5

SHA256
e323304a3065de0f5dfcae24bf61fc0f7ea99343feacfa603417e7679a558149

SHA512
8b31629236b9818bddda317ba0b631eb2cfc289f3fdd2518aa26af1df13f59459d3fb2839b5c5e1910b4dd50b8efa9391afe05269d778b2e6bbd518dd2570162

Download Submit
memory/4068-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4068-133-0x00000000004C0000-0x00000000004D2000-memory.dmp

Filesize
72KB

Download
memory/4068-134-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4068-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download