ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f.exe
Size

24KB
MD5

f52dd568afdf3ab27817d849162a3e71
SHA1

815da8ca05870e6e77fc387195c14f4119c6787e
SHA256

ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f
SHA512

c225f68bdc52d4ef60c67a7a8996a032e10fa0b4cc3c8add27ce6b9b6671fd7c5ed02d7c290522c6f277b0dc71bdd47ad2959061dbd2c4c1e90b92f9267a4bb4
SSDEEP

384:vOCaqrpMsc29ZpvyF73t+15raYhLoe0qHUEE9FQhVNLqvW:vOCNNyFA15raYhL/HUEE9FQhVB5

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2204	2492	ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f.exe	80
PID 2492 wrote to memory of 2204	2492	ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f.exe	80
PID 2492 wrote to memory of 2204	2492	ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f.exe	80
PID 2492 wrote to memory of 4380	2492	ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f.exe	82
PID 2492 wrote to memory of 4380	2492	ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f.exe	82
PID 2492 wrote to memory of 4380	2492	ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f.exe	82

C:\Users\Admin\AppData\Local\Temp\ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f.exe
"C:\Users\Admin\AppData\Local\Temp\ff280de1b7694c27f0a10c973f46454e802cd7900bd3e749fcc111e54d784f7f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RenUS.bat" "
  2⤵
  PID:2204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RenUS.bat" "
  2⤵
  PID:4380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RenUS.bat

Filesize
29B

MD5
786cc672eec7f652559bb0b06e61f082

SHA1
40bf58b092b156de7a565d28e6878c2498d1b38f

SHA256
f9771ca14c659a88d451318f9a93e591072809f8785598b83fed96191db8f1d9

SHA512
1195b11b03747d52738574b59156250e78dc929cd61216c5637a47c360e52ba329c734b846f8a9548faec594e3b7f5357077cb37f40ce366c2834bfa0f5ed3ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\RenUS.bat

Filesize
29B

MD5
d6fd0ad6a7cf9ccf45a778569daf9670

SHA1
b5d81be999b2519d995c693c97cccd3cfb364734

SHA256
b4684e4508ddd215b51e6fe02b7cfd4468dcdd8573cf69ac40c9883ea0b092d1

SHA512
dbe6df1b2e222dd460ed10816458921ec694e88b50db16a81482fdfa9dd98cd627fc52c650e79d51c75baf7b5e7cd3b40692a5fa63fc05aa65b85d5ea5152a82

Download Submit