5334f5e5af340bf83bbfc07aa95e1c961c0b857d747fb956152def5c54b7476b

Analysis

max time kernel
83s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5334f5e5af340bf83bbfc07aa95e1c961c0b857d747fb956152def5c54b7476b.exe
Size

96KB
MD5

b903f8dd483acee6a807cb2d98cae4cd
SHA1

1d183c67cc863e9f8f22fa6fc74c0cf249376ea5
SHA256

5334f5e5af340bf83bbfc07aa95e1c961c0b857d747fb956152def5c54b7476b
SHA512

fb11c6e1eac148485535871cb37d9970fbea5a251caef12bcd2252e0e5f50f2dfe4f53d1f236f4223aee58abaf24608f0b42ec51f4a63bfa0e83e7c6bb516d6f
SSDEEP

1536:lRSnTZfr0od8rUhy3edOjL/iJBR4MfpheJVxvcHOG7FIy:8D0oZhy1CJBR4MfXeJVxvcHOG7FIy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5334f5e5af340bf83bbfc07aa95e1c961c0b857d747fb956152def5c54b7476b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 804	400	5334f5e5af340bf83bbfc07aa95e1c961c0b857d747fb956152def5c54b7476b.exe	82
PID 400 wrote to memory of 804	400	5334f5e5af340bf83bbfc07aa95e1c961c0b857d747fb956152def5c54b7476b.exe	82
PID 400 wrote to memory of 804	400	5334f5e5af340bf83bbfc07aa95e1c961c0b857d747fb956152def5c54b7476b.exe	82

C:\Users\Admin\AppData\Local\Temp\5334f5e5af340bf83bbfc07aa95e1c961c0b857d747fb956152def5c54b7476b.exe
"C:\Users\Admin\AppData\Local\Temp\5334f5e5af340bf83bbfc07aa95e1c961c0b857d747fb956152def5c54b7476b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ybb..bat" > nul 2> nul
  2⤵
  PID:804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ybb..bat

Filesize
274B

MD5
0c76064196c5e12dd61877168f1dc613

SHA1
37ae16eb182b45ce5cc86b5d515b215c2092d2fa

SHA256
f2565879a5b5e39e54e691c84cefcb7df4b8057d4340eefb6fec2719d9f2a088

SHA512
88bdd02a99509f17ad66a4b5ff9ff368a1208109f2a4d9febdceaa93d1ede4d3f2e6697b14a8712b6870634fbae527de3f9a421e230a96f019d414a208132ae6

Download Submit
memory/400-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/400-134-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download