9547721c3a5e38e15430cb2db5ee743f46473b00af209edfc48403861f72c45c

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9547721c3a5e38e15430cb2db5ee743f46473b00af209edfc48403861f72c45c.exe
Size

76KB
MD5

dad01f677cbcba0327b55bfa2ebf74fc
SHA1

baf07b3553cd3b729dcf0c78d30a643d5a44c631
SHA256

9547721c3a5e38e15430cb2db5ee743f46473b00af209edfc48403861f72c45c
SHA512

20f89993d7aac1ac3bb8c05d3fe7aac85bf52a9c892ce13e0a93d8e52ff6f14a952a43d71ab422cada78ce3c2bce8fa6b752721d657ac851b2091276ed6d84b4
SSDEEP

1536:9Bqpt2LAGc9eDLEOkNCivSDarpXgknbIiWz8ykBXFiEQQUGF:Qt2Ly9e0O0NxrpXgknbIZzQBX4eNF

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	9547721c3a5e38e15430cb2db5ee743f46473b00af209edfc48403861f72c45c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 908	4828	9547721c3a5e38e15430cb2db5ee743f46473b00af209edfc48403861f72c45c.exe	81
PID 4828 wrote to memory of 908	4828	9547721c3a5e38e15430cb2db5ee743f46473b00af209edfc48403861f72c45c.exe	81
PID 4828 wrote to memory of 908	4828	9547721c3a5e38e15430cb2db5ee743f46473b00af209edfc48403861f72c45c.exe	81

C:\Users\Admin\AppData\Local\Temp\9547721c3a5e38e15430cb2db5ee743f46473b00af209edfc48403861f72c45c.exe
"C:\Users\Admin\AppData\Local\Temp\9547721c3a5e38e15430cb2db5ee743f46473b00af209edfc48403861f72c45c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ahz..bat" > nul 2> nul
  2⤵
  PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ahz..bat

Filesize
274B

MD5
7feb8a333c0091fc5b643960ace0d5b2

SHA1
f7fd771b907b3087fb768b7e8f5ec7311610b6bd

SHA256
3c776ecbf08a2a0f85ec9f71b5be07631f046c166d50591f5fb69a2ad4082e61

SHA512
c4187d4319f3a0e38fc6e87e3f03147f61722850b76a5b429d311b6b162a9ac45f8bb489223f25618db3a5e3e9c737a610542b1cebd2824d91529b0235413211

Download Submit
memory/4828-132-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4828-134-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download