944c80ed4dcbc89c89c339ce300abf37e82097e638c7c25c66a30abb04ae9085

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

944c80ed4dcbc89c89c339ce300abf37e82097e638c7c25c66a30abb04ae9085.exe
Size

66KB
MD5

3883340510b6ab24bffdab6d8632a0d8
SHA1

b12167551d09ee58004d059959b89fbb14363811
SHA256

944c80ed4dcbc89c89c339ce300abf37e82097e638c7c25c66a30abb04ae9085
SHA512

14eae966caebe835fd3a6adfd5c09708110c7e9929c5952b72ea2fd9099cd70931449af222f467fc6d07e238b5bedfd966f59a7e2ce5016f38bd812b4a4fee3e
SSDEEP

1536:PMPBTxV+1ADAx2p82Ug8KCRO3ZJlb/Lkb3gXy:PMPBgADAs89RGtgcXy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	944c80ed4dcbc89c89c339ce300abf37e82097e638c7c25c66a30abb04ae9085.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4984	1224	944c80ed4dcbc89c89c339ce300abf37e82097e638c7c25c66a30abb04ae9085.exe	79
PID 1224 wrote to memory of 4984	1224	944c80ed4dcbc89c89c339ce300abf37e82097e638c7c25c66a30abb04ae9085.exe	79
PID 1224 wrote to memory of 4984	1224	944c80ed4dcbc89c89c339ce300abf37e82097e638c7c25c66a30abb04ae9085.exe	79

C:\Users\Admin\AppData\Local\Temp\944c80ed4dcbc89c89c339ce300abf37e82097e638c7c25c66a30abb04ae9085.exe
"C:\Users\Admin\AppData\Local\Temp\944c80ed4dcbc89c89c339ce300abf37e82097e638c7c25c66a30abb04ae9085.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ecf..bat" > nul 2> nul
  2⤵
  PID:4984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ecf..bat

Filesize
274B

MD5
c1717aa816cd399fe0f49dd21f7469af

SHA1
7d29c000c43947fd2a2a0499cbf219b637359780

SHA256
3a49889179f223059086e806fac8caa7eb45dc5c2d96d38a7b3f2bc54111aeb3

SHA512
d1cf80a4d74555a53fe0af20ed4bdab28957518a781808fb4337322b73944d1509066c199314657286e7d750c241776b070bd35b56dc820e753fea35085724b1

Download Submit
memory/1224-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1224-133-0x00000000006F0000-0x000000000070E000-memory.dmp

Filesize
120KB

Download
memory/1224-134-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1224-136-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download