b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae

Analysis

max time kernel
137s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe
Size

64KB
MD5

bbb2750f399b2cbc8f2de9649c58772b
SHA1

2269d16ab10fdf3187014c60292338c68b26f76c
SHA256

b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae
SHA512

96e40e540510bb8334d2065b2c889240502677b46f750b57234f4efd3d34bf13639c8c3eb0452bcdab73b5ac9bbbede1f86d8abffac8f05a35f527a5f1fad2ae
SSDEEP

1536:xET64WKch3dQzOwtwSI3yHBUJu5OXIvzpjIp/n:xq64Wx3dmqSSyHBknGzpjA/n

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3252	4980	b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe	81
PID 4980 wrote to memory of 3252	4980	b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe	81
PID 4980 wrote to memory of 3252	4980	b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe	81

C:\Users\Admin\AppData\Local\Temp\b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe
"C:\Users\Admin\AppData\Local\Temp\b8feae91a5021d72e6b3e80199bd52d9a212f905025d9b1bdd779f0afb7756ae.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Phz..bat" > nul 2> nul
  2⤵
  PID:3252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Phz..bat

Filesize
274B

MD5
d9305a1b8b55c52f80f06b23f0cf5cb9

SHA1
4a33834bf0fc295a6b373d17259afc125b9625c8

SHA256
3d90f259bcc7f14722f35c40d9e2171f207fa8b5df1ea682c466369bc2332e60

SHA512
0f675f85c08988268c45f496871db502f0a48f0690a6c9f660d62e022817f5e302e6adb6c3f76a1ba1849c745e10ef91487654bb8dbf37dba29dfdb42f3045ce

Download Submit
memory/4980-132-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4980-133-0x00000000021E0000-0x00000000021F8000-memory.dmp

Filesize
96KB

Download
memory/4980-134-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4980-136-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download