1ab27782889679bab23fa77dd124373e9a7486b3907ed5e3bf6953d4771db353

Analysis

max time kernel
205s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ab27782889679bab23fa77dd124373e9a7486b3907ed5e3bf6953d4771db353.exe
Size

67KB
MD5

4ed01a2c2bf553d48d98d5b7a7e75ac0
SHA1

a3ba3e8b2ce9251ba2d2f8f10ac25a4bbf7b6e90
SHA256

1ab27782889679bab23fa77dd124373e9a7486b3907ed5e3bf6953d4771db353
SHA512

2d9748f4e498a970786370f30d5976ce25f9498c910a219cee29c1b32d92e77a59c9500411500e9f604d415e3f4157bf6ed54f9ae3b9a12a93b195f0ab5250d7
SSDEEP

1536:2wetP10SuUdZuhRfUwvw37j/XrTnEmgIFlkFVtJ/L:2vc0ZupIrj/XzD4d/L

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	1ab27782889679bab23fa77dd124373e9a7486b3907ed5e3bf6953d4771db353.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4636	1ab27782889679bab23fa77dd124373e9a7486b3907ed5e3bf6953d4771db353.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2832	4636	1ab27782889679bab23fa77dd124373e9a7486b3907ed5e3bf6953d4771db353.exe	81
PID 4636 wrote to memory of 2832	4636	1ab27782889679bab23fa77dd124373e9a7486b3907ed5e3bf6953d4771db353.exe	81
PID 4636 wrote to memory of 2832	4636	1ab27782889679bab23fa77dd124373e9a7486b3907ed5e3bf6953d4771db353.exe	81

C:\Users\Admin\AppData\Local\Temp\1ab27782889679bab23fa77dd124373e9a7486b3907ed5e3bf6953d4771db353.exe
"C:\Users\Admin\AppData\Local\Temp\1ab27782889679bab23fa77dd124373e9a7486b3907ed5e3bf6953d4771db353.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Fwz..bat" > nul 2> nul
  2⤵
  PID:2832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Fwz..bat

Filesize
274B

MD5
594b2512d59a50c47fe7c3c1ae485e72

SHA1
776f1e4f12078ee53ccfa0ccd03864f65516b254

SHA256
c5fc3ccc013284cd727d439d13935892bcab38a4fd127fc7bd43b2bd34a6a49d

SHA512
74c3ca3aa62968377be72e94ff255bfc592ecf1304d797e5469296c3c129ebc6fc9bd07d5e0d0d4d6c4321154ae7171f8bdc62457cf1f3ed6db0e5af7d0c3ebd

Download Submit
memory/2832-135-0x0000000000000000-mapping.dmp

Download
memory/4636-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4636-133-0x0000000002020000-0x0000000002032000-memory.dmp

Filesize
72KB

Download
memory/4636-134-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4636-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download