b374909991625d6547b4b03e91a89a6cd56210a71b0784ee37a1ca91151b93aa

Analysis

max time kernel
167s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b374909991625d6547b4b03e91a89a6cd56210a71b0784ee37a1ca91151b93aa.exe
Size

93KB
MD5

f34f6f82e4db366a070efeeea70a78b7
SHA1

e67af2118fb411c547df65b03fa6aed29049bb95
SHA256

b374909991625d6547b4b03e91a89a6cd56210a71b0784ee37a1ca91151b93aa
SHA512

cd7659cbf3880403a7090635fac622752106162df59ebbf05c5ef643f3b6560d321148e116724e357be1ae0acb64da2479d1a798194c00c93fe6d5fe78f21a09
SSDEEP

1536:Ili/HCAriIYdCqDR6RrgwEqa04s9G0bn9PI16LUoMvdYFIy:irvDxqus9Gmhx4rlYFIy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	b374909991625d6547b4b03e91a89a6cd56210a71b0784ee37a1ca91151b93aa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 3136	3228	b374909991625d6547b4b03e91a89a6cd56210a71b0784ee37a1ca91151b93aa.exe	84
PID 3228 wrote to memory of 3136	3228	b374909991625d6547b4b03e91a89a6cd56210a71b0784ee37a1ca91151b93aa.exe	84
PID 3228 wrote to memory of 3136	3228	b374909991625d6547b4b03e91a89a6cd56210a71b0784ee37a1ca91151b93aa.exe	84

C:\Users\Admin\AppData\Local\Temp\b374909991625d6547b4b03e91a89a6cd56210a71b0784ee37a1ca91151b93aa.exe
"C:\Users\Admin\AppData\Local\Temp\b374909991625d6547b4b03e91a89a6cd56210a71b0784ee37a1ca91151b93aa.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Mcz..bat" > nul 2> nul
  2⤵
  PID:3136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mcz..bat

Filesize
274B

MD5
840683c65954af2ec3260d0d36200ca5

SHA1
ded6c856ce7dbb5647d218658479bdd61cace559

SHA256
10d5e9deb00652ead452be0cb9d44e516f59b0d828b614ddf13f9049295611ff

SHA512
fa7fa80c4ae66bb1254eff2a527a538c9ff5acfb1d6e0d9e22bf4a708c2e1963d1569151812d1a082defede4eae4eb6ede0c3c007d0246b58cd8429868ab209d

Download Submit
memory/3228-132-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3228-134-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download