cafeaca185016fb05d60cf6b871a39f6ebf494ada6b21a2caf5a046586525448

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cafeaca185016fb05d60cf6b871a39f6ebf494ada6b21a2caf5a046586525448.exe
Size

98KB
MD5

0dffaeafa77acca9da4a8233e6d0d6f6
SHA1

500b89803639dbe3e1c97f7303f8ca41aff54562
SHA256

cafeaca185016fb05d60cf6b871a39f6ebf494ada6b21a2caf5a046586525448
SHA512

f75443ee96dbeeec7099f85e2b675398b1e4c4b2474ac48ef8f356908d60106b59dbd00fe2c201bc8f8f395934a68c9b1e143442f434c04e569f8e1d205fab3a
SSDEEP

3072:q2hzgKSXgsmyL9eLwcc9nCRxz+WF11vP5k:q40Kogsmy59x9nCjVvP2

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3464-133-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/3464-135-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cafeaca185016fb05d60cf6b871a39f6ebf494ada6b21a2caf5a046586525448.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 2096	3464	cafeaca185016fb05d60cf6b871a39f6ebf494ada6b21a2caf5a046586525448.exe	80
PID 3464 wrote to memory of 2096	3464	cafeaca185016fb05d60cf6b871a39f6ebf494ada6b21a2caf5a046586525448.exe	80
PID 3464 wrote to memory of 2096	3464	cafeaca185016fb05d60cf6b871a39f6ebf494ada6b21a2caf5a046586525448.exe	80

C:\Users\Admin\AppData\Local\Temp\cafeaca185016fb05d60cf6b871a39f6ebf494ada6b21a2caf5a046586525448.exe
"C:\Users\Admin\AppData\Local\Temp\cafeaca185016fb05d60cf6b871a39f6ebf494ada6b21a2caf5a046586525448.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  PID:2096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
274B

MD5
1f0ba0e2c1fb28ed7cb25dfbcc16c785

SHA1
7a54256909aac7c69d78fee218ed351cf10ebe09

SHA256
839f824a703fdb13562362cfeb02a195fbe735d152d5e61c911f17e82f1676a6

SHA512
f766af485bf2512c4d7184f60e1b78465ea3b59a8834d2741e2a1ee4c6f775436d04c87e0c6fcccd6c1e74a874dd5e8230f97f3e4f973ea8fa2fcecd2baa1556

Download Submit
memory/3464-132-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3464-133-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3464-135-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download