c2f72bc4ee114a79bb264a514650dc4f3706989e8e6d7de56fcd560205e4650a

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2f72bc4ee114a79bb264a514650dc4f3706989e8e6d7de56fcd560205e4650a.exe
Size

100KB
MD5

4dbe960db98d7b588c07ae3fb9383aef
SHA1

e0dd50ebea3cf05ab9b4dcb39d2e19a5e3717f59
SHA256

c2f72bc4ee114a79bb264a514650dc4f3706989e8e6d7de56fcd560205e4650a
SHA512

060e522fb6679e8559d98b4307fac38a6c35063561b01a682b6a7b9178e0635bbc54923091a4e67fffce137f396412e353a5b29cf9ed4cc5a9eaeb7936716f9b
SSDEEP

1536:g+ZxkiqzfcFDy95jC+t6fZGq3+mzwK5aB+yipX6vXgozR0B4m9:nx0zEFDejJIxGq3gKG+yGmgoV0GE

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c2f72bc4ee114a79bb264a514650dc4f3706989e8e6d7de56fcd560205e4650a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	c2f72bc4ee114a79bb264a514650dc4f3706989e8e6d7de56fcd560205e4650a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c2f72bc4ee114a79bb264a514650dc4f3706989e8e6d7de56fcd560205e4650a.exe

description	pid	process	target process
PID 880 wrote to memory of 3984	880	c2f72bc4ee114a79bb264a514650dc4f3706989e8e6d7de56fcd560205e4650a.exe	cmd.exe
PID 880 wrote to memory of 3984	880	c2f72bc4ee114a79bb264a514650dc4f3706989e8e6d7de56fcd560205e4650a.exe	cmd.exe
PID 880 wrote to memory of 3984	880	c2f72bc4ee114a79bb264a514650dc4f3706989e8e6d7de56fcd560205e4650a.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\c2f72bc4ee114a79bb264a514650dc4f3706989e8e6d7de56fcd560205e4650a.exe
"C:\Users\Admin\AppData\Local\Temp\c2f72bc4ee114a79bb264a514650dc4f3706989e8e6d7de56fcd560205e4650a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Nnp..bat" > nul 2> nul
2⤵
PID:3984

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Nnp..bat
Filesize
274B

MD5
397f3a30904d55ac665bafccc822e00d

SHA1
cbd6604111fb4fe418de21413624520bdab6a71e

SHA256
0c994a085d37523332e4e3073c6ee398c6a94cccc9ef6b5dae41d9c5769db56b

SHA512
7e2b77d6eea4ca273d87277be42f8a33eae95204ad63b2e60c3a9d5fa08343bdbb1e52735db5bae1e62160f74a05d984dad4b6a8689646c01b7e4ec5d9f1edf7

Download Submit
memory/880-135-0x00000000021B0000-0x00000000021C7000-memory.dmp

Filesize
92KB

Download
memory/880-136-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/880-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/880-139-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3984-138-0x0000000000000000-mapping.dmp

Download