Analysis

  • max time kernel
    137s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 07:41

General

  • Target

    b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe

  • Size

    64KB

  • MD5

    bbb2750f399b2cbc8f2de9649c58772b

  • SHA1

    2269d16ab10fdf3187014c60292338c68b26f76c

  • SHA256

    b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae

  • SHA512

    96e40e540510bb8334d2065b2c889240502677b46f750b57234f4efd3d34bf13639c8c3eb0452bcdab73b5ac9bbbede1f86d8abffac8f05a35f527a5f1fad2ae

  • SSDEEP

    1536:xET64WKch3dQzOwtwSI3yHBUJu5OXIvzpjIp/n:xq64Wx3dmqSSyHBknGzpjA/n

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe
    "C:\Users\Admin\AppData\Local\Temp\b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Phz..bat" > nul 2> nul
      2⤵
        PID:3252

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Phz..bat

      Filesize

      274B

      MD5

      d9305a1b8b55c52f80f06b23f0cf5cb9

      SHA1

      4a33834bf0fc295a6b373d17259afc125b9625c8

      SHA256

      3d90f259bcc7f14722f35c40d9e2171f207fa8b5df1ea682c466369bc2332e60

      SHA512

      0f675f85c08988268c45f496871db502f0a48f0690a6c9f660d62e022817f5e302e6adb6c3f76a1ba1849c745e10ef91487654bb8dbf37dba29dfdb42f3045ce

    • memory/4980-132-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/4980-133-0x00000000021E0000-0x00000000021F8000-memory.dmp

      Filesize

      96KB

    • memory/4980-134-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/4980-136-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB