9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f

Analysis

max time kernel
408s
max time network
440s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe
Size

7.2MB
MD5

03897d36efffba4c9afa960b8b182cd1
SHA1

fe8000d29c7104f89ae78c857d4b7f9711b4f40c
SHA256

9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f
SHA512

9e7bbd9b5f4f7b6f86d14a004d25b9cd542c75c7abd8babaffac852f1cce6fe0041214340931feaf2c507c964ccf78c40cf2800697bcdfb5e3af31788892be5d
SSDEEP

98304:Q2gBwkDXtPdWrbO4izWGOBox7W1EkDXtPdWrbO4izWXOBox7W1N:Q2gakWrbRiFOXKkWrbRiQOX/

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
364	ServerUnk1.exe
1180	ServerUnk2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServerUnk1.exe	9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe
File created	C:\Windows\ServerUnk2.exe	9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 364	1496	9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe	86
PID 1496 wrote to memory of 364	1496	9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe	86
PID 1496 wrote to memory of 364	1496	9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe	86
PID 1496 wrote to memory of 1180	1496	9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe	87
PID 1496 wrote to memory of 1180	1496	9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe	87
PID 1496 wrote to memory of 1180	1496	9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe	87

C:\Users\Admin\AppData\Local\Temp\9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe
"C:\Users\Admin\AppData\Local\Temp\9bb225940c0789de800546f76067ed6ea0582fca756143e3402dcb5cb1d17a0f.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\ServerUnk1.exe
  "C:\Windows\ServerUnk1.exe"
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\ServerUnk2.exe
  "C:\Windows\ServerUnk2.exe"
  2⤵
  - Executes dropped EXE
  PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ServerUnk1.exe

Filesize
3.3MB

MD5
8a3c16455c21b441802f6752e23d34e7

SHA1
a29b29b6c4df293cbf0c308b71ed7dfab6aca847

SHA256
9ad01df625c5faa7d60882c7dc869154b83a99d4e22fc0dff96be11c9de29cf5

SHA512
78545ac2b80ae05ee43daa50da9d81ca4dfa55fefa696cb80b9a25eabec520ddea511f0844a5c5e8ff7b7353e48ace22038b5ad78e61fc9c9b9bfbf1fb9d7548

Download Submit
C:\Windows\ServerUnk1.exe

Filesize
3.3MB

MD5
8a3c16455c21b441802f6752e23d34e7

SHA1
a29b29b6c4df293cbf0c308b71ed7dfab6aca847

SHA256
9ad01df625c5faa7d60882c7dc869154b83a99d4e22fc0dff96be11c9de29cf5

SHA512
78545ac2b80ae05ee43daa50da9d81ca4dfa55fefa696cb80b9a25eabec520ddea511f0844a5c5e8ff7b7353e48ace22038b5ad78e61fc9c9b9bfbf1fb9d7548

Download Submit
C:\Windows\ServerUnk2.exe

Filesize
3.3MB

MD5
797cbd5558bd7f545cf808ec0b0d172d

SHA1
bb44b16af0de2b37ebc9fdfe05f44636b3a92f00

SHA256
2b15bf5189e4a6d82d1e124cf89f9db317785b932af41b4e73679d70031128a0

SHA512
99669ddaf06ef28e5ba34ac4b7265acb8ca6ac7ce09b3dfba24d2b8bb12607e0261a291755939b0c721182b1fec28f67efff9eb69456e028d24ce509aaec5121

Download Submit
C:\Windows\ServerUnk2.exe

Filesize
3.3MB

MD5
797cbd5558bd7f545cf808ec0b0d172d

SHA1
bb44b16af0de2b37ebc9fdfe05f44636b3a92f00

SHA256
2b15bf5189e4a6d82d1e124cf89f9db317785b932af41b4e73679d70031128a0

SHA512
99669ddaf06ef28e5ba34ac4b7265acb8ca6ac7ce09b3dfba24d2b8bb12607e0261a291755939b0c721182b1fec28f67efff9eb69456e028d24ce509aaec5121

Download Submit