3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5

Analysis

max time kernel
151s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe
Size

343KB
MD5

37f698206c504b3d910aa80159176390
SHA1

affe89ead19dcb98eb6b3add29b0411b94b68ee9
SHA256

3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5
SHA512

6a75ddd391616e5c4074557ac2eff5a519d295b3c115004481392cf8d70f9addf07805d87f082866036bea3cc1b3cd471e769396b55e8dc908ed11510ec70801
SSDEEP

6144:WJ+SJhKb7cpwPBAggA6dqEGXDFqJH1dabccbi+bNjS8ki/gtL+fdzUTwMQsWt:zvcpwPrgLdq/0j2bNTtglW

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3944	QQ.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2160	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2160	5064	3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe	81
PID 5064 wrote to memory of 2160	5064	3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe	81
PID 5064 wrote to memory of 2160	5064	3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe	81

C:\Users\Admin\AppData\Local\Temp\3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe
"C:\Users\Admin\AppData\Local\Temp\3912105fb7205a446f8bd73ebd21efd1c628b1d243a339c8c0d3fd684697b3e5.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\s.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2160
- C:\Users\Admin\AppData\Roaming\QQ.exe
  "C:\Users\Admin\AppData\Roaming\QQ.exe"
  2⤵
  - Executes dropped EXE
  PID:3944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\QQ.exe

Filesize
329KB

MD5
8ca122348a7e3001df407e195dfeb081

SHA1
bb4153350484dbb7dc1fc882e6d4847337d0b544

SHA256
6c9016245e6f74606b371c662b32a93ab436958314373c9564cab2ed41779983

SHA512
80bad5990264255a2a1a52ba57f7a478121ddac49c0440200fecdfbf4d0ccbf776f714795a979560a8a2a01001dac1205f2324ac30bf0f3438f3d1150fd4a799

Download Submit
C:\Users\Admin\AppData\Roaming\s.txt

Filesize
21B

MD5
4b0643cd867cea48ebff640971b05e7b

SHA1
4e812ec2c48c6946989d3668a16446c2111be026

SHA256
f441ce43dfda2688b421faa136383e173caf18aaed30c870229bbff3c4b6b36a

SHA512
a1a0ce3ffc7082f6d9c7ff68180be1ef3eb2969996b749549d92727ac6c10b047eb8753c050dc3986d349f16519b3180c7f16243f34c034763ac4db1f9a14d58

Download Submit
memory/3944-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download