c6041a556adcd2512f5ba110a2f2702d1b77226d1864e7606df99de9829f3441

Analysis

max time kernel
237s
max time network
311s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c6041a556adcd2512f5ba110a2f2702d1b77226d1864e7606df99de9829f3441.exe
Size

172KB
MD5

6154c7ea76642820f2db3a86491405e7
SHA1

421be380ab18041f2573db9f5cae7c77127d923d
SHA256

c6041a556adcd2512f5ba110a2f2702d1b77226d1864e7606df99de9829f3441
SHA512

23b75e5b04a810f00dc5126f0f69372469f9ae1beb80f578789cc3aab55581f3af97203299e95042cf36e694ef68231f592d37fa133a39ac08f27a16ff065820
SSDEEP

3072:7N0GPaXTWQmnfizgd3AWO0/5OXb6e4kRoRicExK6zzama+9eQrso:yrC8P4Tf2zzRaee

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3104	c6041a556PZYM.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	c6041a556adcd2512f5ba110a2f2702d1b77226d1864e7606df99de9829f3441.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3104	c6041a556PZYM.exe
3104	c6041a556PZYM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3104	c6041a556PZYM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3104	4720	c6041a556adcd2512f5ba110a2f2702d1b77226d1864e7606df99de9829f3441.exe	81
PID 4720 wrote to memory of 3104	4720	c6041a556adcd2512f5ba110a2f2702d1b77226d1864e7606df99de9829f3441.exe	81
PID 4720 wrote to memory of 3104	4720	c6041a556adcd2512f5ba110a2f2702d1b77226d1864e7606df99de9829f3441.exe	81

C:\Users\Admin\AppData\Local\Temp\c6041a556adcd2512f5ba110a2f2702d1b77226d1864e7606df99de9829f3441.exe
"C:\Users\Admin\AppData\Local\Temp\c6041a556adcd2512f5ba110a2f2702d1b77226d1864e7606df99de9829f3441.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\c6041a556PZYM.exe
  "C:\Users\Admin\AppData\Local\Temp\c6041a556PZYM.exe" -yue
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:3104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c6041a556PZYM.exe

Filesize
172KB

MD5
cb531b53cd12212b3b7de68b52c9be76

SHA1
aa825035a32cb82a33d061c29d9e66b89db0f8be

SHA256
8b79ca6640f4e5990c7253d0bcfefb07ebe138ca59d23d4ecf3c4599af302d49

SHA512
fc4ad75c60d54c9479b85b654ccd67467b85e77c6da4bb14e5037f0b5e6abc96a10557f7d2421f8baabcb264c3e5284ab4767b190c17b4b5e30cc2f56d94283f

Download Submit
C:\Users\Admin\AppData\Local\Temp\c6041a556PZYM.exe

Filesize
172KB

MD5
cb531b53cd12212b3b7de68b52c9be76

SHA1
aa825035a32cb82a33d061c29d9e66b89db0f8be

SHA256
8b79ca6640f4e5990c7253d0bcfefb07ebe138ca59d23d4ecf3c4599af302d49

SHA512
fc4ad75c60d54c9479b85b654ccd67467b85e77c6da4bb14e5037f0b5e6abc96a10557f7d2421f8baabcb264c3e5284ab4767b190c17b4b5e30cc2f56d94283f

Download Submit