85ddb337993336db52479eaefeb2d6674d56f9f3ef9a59624571a688fa323e28

Analysis

max time kernel
92s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85ddb337993336db52479eaefeb2d6674d56f9f3ef9a59624571a688fa323e28.exe
Size

667KB
MD5

85f2a740477b6ee87773ae026ee95404
SHA1

72e8e7ddfa93e1a6bc3e5afbd6910a24375e1bf7
SHA256

85ddb337993336db52479eaefeb2d6674d56f9f3ef9a59624571a688fa323e28
SHA512

15fc60e30906d9d340061db209a541644224ce17776ff3cd8b9ffa642f3a3d666d2bb6b40b89e823bfc24f47d2e1ac02d64ae02453bba4f325321c87b771cf8d
SSDEEP

12288:u9f1Ks4SjTyICxkawPKCEXOdNn/HnURqF3Z4mxx0BzAIozoGf4xN2:u99KsH5sXwPp/UqQmXeoUGf4xE

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5092	2008_server.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	85ddb337993336db52479eaefeb2d6674d56f9f3ef9a59624571a688fa323e28.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	2008_server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 5092	3116	85ddb337993336db52479eaefeb2d6674d56f9f3ef9a59624571a688fa323e28.exe	79
PID 3116 wrote to memory of 5092	3116	85ddb337993336db52479eaefeb2d6674d56f9f3ef9a59624571a688fa323e28.exe	79
PID 3116 wrote to memory of 5092	3116	85ddb337993336db52479eaefeb2d6674d56f9f3ef9a59624571a688fa323e28.exe	79
PID 5092 wrote to memory of 5112	5092	2008_server.exe	80
PID 5092 wrote to memory of 5112	5092	2008_server.exe	80

C:\Users\Admin\AppData\Local\Temp\85ddb337993336db52479eaefeb2d6674d56f9f3ef9a59624571a688fa323e28.exe
"C:\Users\Admin\AppData\Local\Temp\85ddb337993336db52479eaefeb2d6674d56f9f3ef9a59624571a688fa323e28.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Users\Admin\AppData\Local\Temp\2008_server.exe
  "C:\Users\Admin\AppData\Local\Temp\2008_server.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:5112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2008_server.exe

Filesize
352KB

MD5
4f0d6e8118c661945f51b8f278dda344

SHA1
7d44c548c7d34648b89514cde38243a1d3d5e195

SHA256
0377599e503c0a75b43502d5d91f556e13b8a9ace2bbdc4ad2cac79c483c94a8

SHA512
30bcccca0b606d632a8489f95f16016d361cca7bd11506153c3d4acd69371160fa27897b38ace4cab8a94ba982569c1a5947225ee5192d459e63808dee3b2bf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\2008_server.exe

Filesize
352KB

MD5
4f0d6e8118c661945f51b8f278dda344

SHA1
7d44c548c7d34648b89514cde38243a1d3d5e195

SHA256
0377599e503c0a75b43502d5d91f556e13b8a9ace2bbdc4ad2cac79c483c94a8

SHA512
30bcccca0b606d632a8489f95f16016d361cca7bd11506153c3d4acd69371160fa27897b38ace4cab8a94ba982569c1a5947225ee5192d459e63808dee3b2bf6

Download Submit
memory/3116-132-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3116-133-0x00000000022B0000-0x0000000002304000-memory.dmp

Filesize
336KB

Download
memory/3116-134-0x0000000003420000-0x0000000003423000-memory.dmp

Filesize
12KB

Download
memory/3116-138-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3116-139-0x00000000022B0000-0x0000000002304000-memory.dmp

Filesize
336KB

Download