91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514

Analysis

max time kernel
94s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514.exe
Size

41KB
MD5

7f98778a29aeca6c46988b439c04d13d
SHA1

c7c53c14fa8a1704e2ad45260d19693c043cc8a8
SHA256

91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514
SHA512

747cccf992762146c20e767d6d473a974bc33518a1af16e107d99468e30d4e618770d7119dd702a1511d3165dd808723499748058bfe4f8a13a72302a095f4e6
SSDEEP

768:QGBar1ZIZYnfI9opm6AIHIjaI7g9mVmUnuoNE/W5dRV8:fW1ZIZqI9opm6AIHIjzmUPNzd

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1720	sxhost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	sxhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 1720	4512	91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514.exe	80
PID 4512 wrote to memory of 1720	4512	91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514.exe	80
PID 4512 wrote to memory of 1720	4512	91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514.exe	80
PID 4512 wrote to memory of 4400	4512	91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514.exe	81
PID 4512 wrote to memory of 4400	4512	91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514.exe	81
PID 4512 wrote to memory of 4400	4512	91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514.exe	81
PID 1720 wrote to memory of 4188	1720	sxhost.exe	83
PID 1720 wrote to memory of 4188	1720	sxhost.exe	83
PID 1720 wrote to memory of 4188	1720	sxhost.exe	83

C:\Users\Admin\AppData\Local\Temp\91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514.exe
"C:\Users\Admin\AppData\Local\Temp\91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\sxhost.exe
  "C:\Users\Admin\sxhost.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\sxhost.exe >> NUL
    3⤵
    PID:4188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\91213B~1.EXE >> NUL
  2⤵
  PID:4400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\sxhost.exe

Filesize
41KB

MD5
7f98778a29aeca6c46988b439c04d13d

SHA1
c7c53c14fa8a1704e2ad45260d19693c043cc8a8

SHA256
91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514

SHA512
747cccf992762146c20e767d6d473a974bc33518a1af16e107d99468e30d4e618770d7119dd702a1511d3165dd808723499748058bfe4f8a13a72302a095f4e6

Download Submit
C:\Users\Admin\sxhost.exe

Filesize
41KB

MD5
7f98778a29aeca6c46988b439c04d13d

SHA1
c7c53c14fa8a1704e2ad45260d19693c043cc8a8

SHA256
91213bd154f67eee2266b165dff747372b38aef4722a7324d0f05ab45f01f514

SHA512
747cccf992762146c20e767d6d473a974bc33518a1af16e107d99468e30d4e618770d7119dd702a1511d3165dd808723499748058bfe4f8a13a72302a095f4e6

Download Submit
memory/1720-132-0x0000000000000000-mapping.dmp

Download
memory/4188-136-0x0000000000000000-mapping.dmp

Download
memory/4400-135-0x0000000000000000-mapping.dmp

Download