b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783

Analysis

max time kernel
184s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783.exe
Size

317KB
MD5

7b20676c22c094e9a0291eccb50deac9
SHA1

f3359f67ae2e853630ed009d4af8ecfc548dbc11
SHA256

b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783
SHA512

bd92ac35f86cf1f6499bdc9576927d1694f7c76fd26609c31231fb8bd164c69e536a8acbb5b62c2b3760faebc70bdad0c348d098360dbcdeefdd6439154f2ee1
SSDEEP

6144:D3y579pvPx7iLbii5bkgVuN+xSKV7Wkrsf7Ls+1d8H5/fA0o+:jy579hJOXikbkgaISKVesRLx

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1364	42FFF77B-F1C1-443D-A60B-25B52C1D268F.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783.exe

Loads dropped DLL 1 IoCs

pid	Process
1964	b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1364	1964	b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783.exe	83
PID 1964 wrote to memory of 1364	1964	b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783.exe	83
PID 1964 wrote to memory of 1364	1964	b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783.exe	83
PID 1964 wrote to memory of 3672	1964	b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783.exe	86
PID 1964 wrote to memory of 3672	1964	b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783.exe	86
PID 1964 wrote to memory of 3672	1964	b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783.exe	86

C:\Users\Admin\AppData\Local\Temp\b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783.exe
"C:\Users\Admin\AppData\Local\Temp\b06e0e80819672ab30ec7cf30eec77f68b1af31bb458d5a8a487febc6cfd8783.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\262ef700-1643-4e4a-892b-ce24f04ca6d0\42FFF77B-F1C1-443D-A60B-25B52C1D268F.exe
  "C:\Users\Admin\AppData\Local\Temp\262ef700-1643-4e4a-892b-ce24f04ca6d0\42FFF77B-F1C1-443D-A60B-25B52C1D268F.exe" -y -p96CB0375-E02C-4472-839C-A787C047C727
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" C:\Users\Admin\AppData\Local\Temp\262ef700-1643-4e4a-892b-ce24f04ca6d0\start.hta
  2⤵
  PID:3672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\262ef700-1643-4e4a-892b-ce24f04ca6d0\42FFF77B-F1C1-443D-A60B-25B52C1D268F.exe

Filesize
204KB

MD5
9986ed66aa63899ad7f6cef85f9f8742

SHA1
68f24ecfefbf29195710f6dde85f720f42732963

SHA256
742a5da340fa3da37a70c21c1a646d2a0e767d1ec099c939d126dcdbaa9a69ed

SHA512
9db5add3c1015ef7ef62e270a19d421d076fee4511a16c3ca125046b8f9f4e404b4353e42b32ae1423584706dc49e500b284babaa1b0fbc12bd4827f7431ef2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\262ef700-1643-4e4a-892b-ce24f04ca6d0\42FFF77B-F1C1-443D-A60B-25B52C1D268F.exe

Filesize
204KB

MD5
9986ed66aa63899ad7f6cef85f9f8742

SHA1
68f24ecfefbf29195710f6dde85f720f42732963

SHA256
742a5da340fa3da37a70c21c1a646d2a0e767d1ec099c939d126dcdbaa9a69ed

SHA512
9db5add3c1015ef7ef62e270a19d421d076fee4511a16c3ca125046b8f9f4e404b4353e42b32ae1423584706dc49e500b284babaa1b0fbc12bd4827f7431ef2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\262ef700-1643-4e4a-892b-ce24f04ca6d0\lib19997.dll

Filesize
122KB

MD5
0d1e3567a673d83642b137ff0ffc7b55

SHA1
d294a3481687c29cf1d2ca0a62223f8bb12cd0e9

SHA256
e48c9fbbec71c7c024777cc498d27c4b455eb241e7a42153dc3f7c5aeb2bfedf

SHA512
3ce99ed58eeace8b67c1d932677480319191f03bc6da550399e8ccb66fbc49526f80a58c3ee9b1d0de993aa2512809adb25d566b8bf23b7abb7d35e183c6f8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\262ef700-1643-4e4a-892b-ce24f04ca6d0\lib19997.dll

Filesize
122KB

MD5
0d1e3567a673d83642b137ff0ffc7b55

SHA1
d294a3481687c29cf1d2ca0a62223f8bb12cd0e9

SHA256
e48c9fbbec71c7c024777cc498d27c4b455eb241e7a42153dc3f7c5aeb2bfedf

SHA512
3ce99ed58eeace8b67c1d932677480319191f03bc6da550399e8ccb66fbc49526f80a58c3ee9b1d0de993aa2512809adb25d566b8bf23b7abb7d35e183c6f8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\262ef700-1643-4e4a-892b-ce24f04ca6d0\loader.gif

Filesize
1KB

MD5
e88ebd85dd56110ac6ea93fe0922988e

SHA1
684a31d864d33ff736234c41ac4e8d2c7f90d5ae

SHA256
379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb

SHA512
211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\262ef700-1643-4e4a-892b-ce24f04ca6d0\start.hta

Filesize
1KB

MD5
9bbdda852677117290a7a3f130638079

SHA1
48390e93abf77599ae64023160cb8ae143189777

SHA256
6e8fcc04c8bf6e07448f7bd47cb304f374873045355b66e160db965ca9685f34

SHA512
1d94b9074ac16cc84b76209a258313282437019838c6b759f8e1c9a665ea104b1e5d197c42b5896b4d89fe7087501017d13a5912272084592c5a218dc635aaa9

Download Submit