b4c62f219e204044d4bf316b7c57dab8bd723dd8b6f00fa5ff4836df51d7ad61

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4c62f219e204044d4bf316b7c57dab8bd723dd8b6f00fa5ff4836df51d7ad61.exe
Size

82KB
MD5

33a3f752ed8b6517f8ab8b40b580234b
SHA1

c6e44838c1e051e390f5463136058b1223fc6c9d
SHA256

b4c62f219e204044d4bf316b7c57dab8bd723dd8b6f00fa5ff4836df51d7ad61
SHA512

7cd7b53fdcb7149fe2f152d9cc2da10d09744147bbf7cb38d373bf51730b7d453d77f86a3fbb8f1ddc4c0133daf1969ab312ee23efcf6a7bb1bc7639273583c7
SSDEEP

1536:cm69n24x1XDhknp0YrPnkc04TJL9h4cSanIqLDXujxvUJ:4924jDhkpRrPkc04TJ5hRIqLDXulcJ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	b4c62f219e204044d4bf316b7c57dab8bd723dd8b6f00fa5ff4836df51d7ad61.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4740	b4c62f219e204044d4bf316b7c57dab8bd723dd8b6f00fa5ff4836df51d7ad61.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4092	4740	b4c62f219e204044d4bf316b7c57dab8bd723dd8b6f00fa5ff4836df51d7ad61.exe	81
PID 4740 wrote to memory of 4092	4740	b4c62f219e204044d4bf316b7c57dab8bd723dd8b6f00fa5ff4836df51d7ad61.exe	81
PID 4740 wrote to memory of 4092	4740	b4c62f219e204044d4bf316b7c57dab8bd723dd8b6f00fa5ff4836df51d7ad61.exe	81

C:\Users\Admin\AppData\Local\Temp\b4c62f219e204044d4bf316b7c57dab8bd723dd8b6f00fa5ff4836df51d7ad61.exe
"C:\Users\Admin\AppData\Local\Temp\b4c62f219e204044d4bf316b7c57dab8bd723dd8b6f00fa5ff4836df51d7ad61.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Jbz..bat" > nul 2> nul
  2⤵
  PID:4092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Jbz..bat

Filesize
274B

MD5
ac515eaca8a518bfdff0a8349aff6bda

SHA1
fb3f867c50c8095cb4da7ceb4e483d76cd280847

SHA256
b06439d90da0df75e797b7683d144b080e234815905a20bbd8896c3e9aae0c2d

SHA512
c0b7ff5613dc0937fd96ba5f507132551517c5e676b2ec782bf8295064a20ecaea1953562d1af3ec8bd5d1e1b417d19265df2b25c7208858e92124f3d62eaf05

Download Submit
memory/4740-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4740-133-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4740-135-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download