b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe
Size

121KB
MD5

0d2bf41ed57646c4181e85b29cc39de1
SHA1

e6d3ff7a57489a5e15361257de7d47052fac0b75
SHA256

b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd
SHA512

dd939077c4f52143c3659e79b4d469a174042b339b1e56dd867547a39745d4a3138486a7a734af24d938948a6aabe80f6e1033fee0679aca2aa0d53c20f61260
SSDEEP

3072:jzNWMKKRZYchObK91C8sV6Xmoo4L2SSTJK5i3:jZuuObR8sVImc2SSTJp3

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2264	1400	b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe	81
PID 1400 wrote to memory of 2264	1400	b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe	81
PID 1400 wrote to memory of 2264	1400	b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe	81

C:\Users\Admin\AppData\Local\Temp\b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe
"C:\Users\Admin\AppData\Local\Temp\b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jagi.jpg.vbs"
  2⤵
  PID:2264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jagi.jpg.vbs

Filesize
4KB

MD5
8285f979380bc9f61f9613d9b04fb938

SHA1
f3ac8de375dfb2403b64bd161c6485365ff31b69

SHA256
daba03a6b029e8482d3dc4d9bbe7f65b920c89449625080694e6965ad34ff4a5

SHA512
42455307ce282a1323c7c7eb2454acf1b8b176a8d6ab63905431b6315f80b7209570896b488d57a46f4a8854270faafb2c1c7ced2d35e9de0e90d423726b165a

Download Submit
memory/1400-132-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1400-135-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download