80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6

Analysis

max time kernel
182s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe
Size

67KB
MD5

5d74f48be060fc3a28a857540bf367c7
SHA1

6f41201561af5879c09c354fc254ec39f0e0d41d
SHA256

80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6
SHA512

8e21dadf582b892534e5916526991a096d9f1050def38a9c8ce7801b9ee78ad4703cbe781783e9cb05c87dac4ad0dcc43f80451b3e2e99d89a302ebed2b1c4d3
SSDEEP

1536:2wetP10SuUdZuhRfUwvw37j/XrTnEmgIFlkFVtJ/q:2vc0ZupIrj/XzD4d/q

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1524	80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 212	1524	80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe	82
PID 1524 wrote to memory of 212	1524	80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe	82
PID 1524 wrote to memory of 212	1524	80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe	82

C:\Users\Admin\AppData\Local\Temp\80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe
"C:\Users\Admin\AppData\Local\Temp\80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Zbz..bat" > nul 2> nul
  2⤵
  PID:212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Zbz..bat

Filesize
274B

MD5
87385e039e1670a4ce00d11267f309cc

SHA1
d7a8724b3f915595e3d79de067cee24b29337467

SHA256
61bd1a1b1f364c29f21a6f8b613318be47b412f094fb48b7de63ff29bdbb138b

SHA512
9ab73c681fd6b25f4a9476061d14046f099b141f82b7abe6f743e1e0a042d5b584d9738174d4a74929f52e95402333cabb4b8e09765ce6f64b49bc47012c9b48

Download Submit
memory/1524-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-133-0x00000000021F0000-0x0000000002202000-memory.dmp

Filesize
72KB

Download
memory/1524-134-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download