c94e39de4ff7231dbcc25df43a27fb1c81b8ddc40c775d8fd969796c5c7d098e

Analysis

max time kernel
71s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c94e39de4ff7231dbcc25df43a27fb1c81b8ddc40c775d8fd969796c5c7d098e.exe
Size

617KB
MD5

7fe7c01141513774b98dff2a312e9780
SHA1

e3dc4bb6818b8276d6421a635d14894570a6d541
SHA256

c94e39de4ff7231dbcc25df43a27fb1c81b8ddc40c775d8fd969796c5c7d098e
SHA512

b3e28de01ed1f2c42455359277dbb048c073287354fbc415d46479daefe7d74a8fca355dd82645443b5b3d6ac2cc0e47efbc3714048a493b1868a490e128bd76
SSDEEP

12288:TyjAVb/crEwfbQCdsLn75fBD6rW344bsBYtcBl7g3snZhKR/XCXX:4+bEg0Qs+nFfACKBycBl7gwXyvm

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4356	0.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022f6b-133.dat	upx
behavioral2/files/0x0007000000022f6b-134.dat	upx
behavioral2/memory/4356-135-0x0000000000400000-0x0000000000587000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	c94e39de4ff7231dbcc25df43a27fb1c81b8ddc40c775d8fd969796c5c7d098e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\0.exe	c94e39de4ff7231dbcc25df43a27fb1c81b8ddc40c775d8fd969796c5c7d098e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	4356	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4356	1096	c94e39de4ff7231dbcc25df43a27fb1c81b8ddc40c775d8fd969796c5c7d098e.exe	80
PID 1096 wrote to memory of 4356	1096	c94e39de4ff7231dbcc25df43a27fb1c81b8ddc40c775d8fd969796c5c7d098e.exe	80
PID 1096 wrote to memory of 4356	1096	c94e39de4ff7231dbcc25df43a27fb1c81b8ddc40c775d8fd969796c5c7d098e.exe	80

C:\Users\Admin\AppData\Local\Temp\c94e39de4ff7231dbcc25df43a27fb1c81b8ddc40c775d8fd969796c5c7d098e.exe
"C:\Users\Admin\AppData\Local\Temp\c94e39de4ff7231dbcc25df43a27fb1c81b8ddc40c775d8fd969796c5c7d098e.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\0.exe
  "C:\Windows\0.exe"
  2⤵
  - Executes dropped EXE
  PID:4356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 268
    3⤵
    - Program crash
    PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4356 -ip 4356
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\0.exe

Filesize
621KB

MD5
f6a89b551be9f76837ab937c5d9797f6

SHA1
ed18dc1536f419b0fda539e346817375570abe8b

SHA256
59d7f8d97df0c8dbf27d26b495ad339bbd47ccf700377b1086b59409245aff64

SHA512
feb5edafe1fc7d3d9309775b184405eeb21fcd350a3bb32eb57b897795c3bb0360488e2b8d32818eac7526ceab8689ef58a3e14bad747dc96cc0f9e270789e75

Download Submit
C:\Windows\0.exe

Filesize
621KB

MD5
f6a89b551be9f76837ab937c5d9797f6

SHA1
ed18dc1536f419b0fda539e346817375570abe8b

SHA256
59d7f8d97df0c8dbf27d26b495ad339bbd47ccf700377b1086b59409245aff64

SHA512
feb5edafe1fc7d3d9309775b184405eeb21fcd350a3bb32eb57b897795c3bb0360488e2b8d32818eac7526ceab8689ef58a3e14bad747dc96cc0f9e270789e75

Download Submit
memory/4356-135-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download