Analysis

  • max time kernel
    94s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 07:08

General

  • Target

    b28c23755f047f24b0a73477f6684e795a712cb60c409d6a96eb6a1727b3722c.exe

  • Size

    117KB

  • MD5

    d7551a08eb4264a641b523f3db4f7a49

  • SHA1

    0d2a2eb98140b50967557100b103fcfa76f35fd9

  • SHA256

    b28c23755f047f24b0a73477f6684e795a712cb60c409d6a96eb6a1727b3722c

  • SHA512

    c31995f05dd4617132927403e7d9a62310360a4f79a9a86807219008025ae50864a54a11591d4d44ac78fb47bf40bcb6edc9ddfe04879a3eeed4c59f41571487

  • SSDEEP

    1536:K0qKYV6QvynCXVYeWklluiIPOuaxrgJeu4a6I+:K7P9vynCXpXuDt4N/

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\b28c23755f047f24b0a73477f6684e795a712cb60c409d6a96eb6a1727b3722c.exe
    "C:\Users\Admin\AppData\Local\Temp\b28c23755f047f24b0a73477f6684e795a712cb60c409d6a96eb6a1727b3722c.exe"
    1⤵
    • Checks computer location settings
    PID:904

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/904-132-0x0000000074EC0000-0x0000000075471000-memory.dmp

    Filesize

    5.7MB

  • memory/904-133-0x0000000074EC0000-0x0000000075471000-memory.dmp

    Filesize

    5.7MB

  • memory/904-134-0x0000000074EC0000-0x0000000075471000-memory.dmp

    Filesize

    5.7MB