92bc50f793fb33fdbda877e6a65e90ea7573e2451f700f9740d187955c7e69d0

Analysis

max time kernel
177s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

92bc50f793fb33fdbda877e6a65e90ea7573e2451f700f9740d187955c7e69d0.exe
Size

236KB
MD5

cb1c7492dccd81fcc2daa38079b86478
SHA1

85526f8427f364b1cb31ef3462c99eb4a3c74d87
SHA256

92bc50f793fb33fdbda877e6a65e90ea7573e2451f700f9740d187955c7e69d0
SHA512

3cbc19dbdb79f0a7085f12ec05293dd6e6d9153a8469eb3e4882808fc91c5615a8a031180066a138be56c7288f30693c47829068d1193b0774e3f46acd3d747b
SSDEEP

3072:rGsn+WinPl0S2UDRfwL0cV7GQaeLPAwxZYn48rck:rGFWind2UDKOeLPAqY4M

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
260	D.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	92bc50f793fb33fdbda877e6a65e90ea7573e2451f700f9740d187955c7e69d0.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\D.exe	92bc50f793fb33fdbda877e6a65e90ea7573e2451f700f9740d187955c7e69d0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
260	D.exe
260	D.exe
260	D.exe
260	D.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 260	4544	92bc50f793fb33fdbda877e6a65e90ea7573e2451f700f9740d187955c7e69d0.exe	83
PID 4544 wrote to memory of 260	4544	92bc50f793fb33fdbda877e6a65e90ea7573e2451f700f9740d187955c7e69d0.exe	83
PID 4544 wrote to memory of 260	4544	92bc50f793fb33fdbda877e6a65e90ea7573e2451f700f9740d187955c7e69d0.exe	83
PID 260 wrote to memory of 2744	260	D.exe	41
PID 260 wrote to memory of 2744	260	D.exe	41
PID 260 wrote to memory of 2744	260	D.exe	41
PID 260 wrote to memory of 2744	260	D.exe	41

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2744
- C:\Users\Admin\AppData\Local\Temp\92bc50f793fb33fdbda877e6a65e90ea7573e2451f700f9740d187955c7e69d0.exe
  "C:\Users\Admin\AppData\Local\Temp\92bc50f793fb33fdbda877e6a65e90ea7573e2451f700f9740d187955c7e69d0.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files (x86)\D.exe
    "C:\Program Files (x86)\D.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\D.exe

Filesize
31KB

MD5
98d47e107f4876542cc3f73ff046d2a8

SHA1
5aefe89bbadba9e917a79f81975ce88c78add66b

SHA256
59ebc639d83050cca5e27a2de9ddf135af160b5b11e3c5a7197a014ad9173706

SHA512
217a8087eea56b3e84c3f87d6677ba10990934edb2dc859db3b7a1758fddf81ce2cf5dc6264bdd6541c5bb2ed4779e962b11017da87a94b9c9adeb9a2586ee94

Download Submit
C:\Program Files (x86)\D.exe

Filesize
31KB

MD5
98d47e107f4876542cc3f73ff046d2a8

SHA1
5aefe89bbadba9e917a79f81975ce88c78add66b

SHA256
59ebc639d83050cca5e27a2de9ddf135af160b5b11e3c5a7197a014ad9173706

SHA512
217a8087eea56b3e84c3f87d6677ba10990934edb2dc859db3b7a1758fddf81ce2cf5dc6264bdd6541c5bb2ed4779e962b11017da87a94b9c9adeb9a2586ee94

Download Submit
memory/260-136-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/260-139-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2744-138-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4544-132-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/4544-137-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download