880af2c4a8ec801266c3cc9625a5fe8feb8e09ff031f6c0558fda0ce5492bbb6

Analysis

max time kernel
92s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

880af2c4a8ec801266c3cc9625a5fe8feb8e09ff031f6c0558fda0ce5492bbb6.exe
Size

105KB
MD5

8ad0aa39820562eb46e106b433d04e32
SHA1

18056217ac51f6ce0e98ed34f35826da6091f889
SHA256

880af2c4a8ec801266c3cc9625a5fe8feb8e09ff031f6c0558fda0ce5492bbb6
SHA512

8d56d0e562d129f1fa7b94db43af6c8f347fc425956639284da46ccf938950680e413d35ced3cd18657e730b47df8ab4fecf0f945e5f12c5fc7a82a0f6e58099
SSDEEP

768:b+KGZdJueOxr1PuarJHlVBQavxWOf+u4Dt0XtCVJGCIzIsaJHRQCAxtXfq:bDGEr1PDVBQiWe+b0X0nEIs0RQtXy

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2692-132-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral2/memory/2692-134-0x0000000000400000-0x000000000047D000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	880af2c4a8ec801266c3cc9625a5fe8feb8e09ff031f6c0558fda0ce5492bbb6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2692	880af2c4a8ec801266c3cc9625a5fe8feb8e09ff031f6c0558fda0ce5492bbb6.exe
2692	880af2c4a8ec801266c3cc9625a5fe8feb8e09ff031f6c0558fda0ce5492bbb6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3996	2692	880af2c4a8ec801266c3cc9625a5fe8feb8e09ff031f6c0558fda0ce5492bbb6.exe	81
PID 2692 wrote to memory of 3996	2692	880af2c4a8ec801266c3cc9625a5fe8feb8e09ff031f6c0558fda0ce5492bbb6.exe	81
PID 2692 wrote to memory of 3996	2692	880af2c4a8ec801266c3cc9625a5fe8feb8e09ff031f6c0558fda0ce5492bbb6.exe	81

C:\Users\Admin\AppData\Local\Temp\880af2c4a8ec801266c3cc9625a5fe8feb8e09ff031f6c0558fda0ce5492bbb6.exe
"C:\Users\Admin\AppData\Local\Temp\880af2c4a8ec801266c3cc9625a5fe8feb8e09ff031f6c0558fda0ce5492bbb6.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  PID:3996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
274B

MD5
9740fc05fc0e5000b4c47ff06f9d78f6

SHA1
501ae875f0a825e84ec9c54847ad1d7ce34506fd

SHA256
56f21b666c03205cdc9fa5ab52165790f28968615be2147c7762aea2076d2640

SHA512
003cec0ca5ebbc5940066065700f6b47272b3af201c34d2f5b7d642f7b6deb488bf68179d1f3eb0c9f6ee6ba14309eaad5df8034a881e090013ee2b6d6e8e7a6

Download Submit
memory/2692-132-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2692-134-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download