a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe
Size

421KB
MD5

3c973afff6acbb49be83d0db70293ed6
SHA1

3407ba702243310e5601e5174e9696f5a970cd5a
SHA256

a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9
SHA512

8a406fa57509e229d93684eb83a1d471e0d159ff16a80084c9dfd1bf2fd3d2dcd8dae91b3b8a29dd0205c596dc62e7fb1d3477fb34adb7de5b2086c981705c76
SSDEEP

12288:DjODTivE9GzlZ3yPRpb+Wvo3/nZFozAKR4pI:DjOysIhZ3ORpbBofZFv7pI

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2728	AutoInst.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2728	AutoInst.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2728	4940	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe	81
PID 4940 wrote to memory of 2728	4940	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe	81
PID 4940 wrote to memory of 2728	4940	a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe	81

C:\Users\Admin\AppData\Local\Temp\a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe
"C:\Users\Admin\AppData\Local\Temp\a7a6b3d6b8ea4a66bf075254da67df46be8d9d37dc9046b127b63b2a494e8be9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\7zS8B0E.tmp\AutoInst.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS8B0E.tmp\AutoInst.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS8B0E.tmp\AutoInst.exe

Filesize
805KB

MD5
6709897005120aec5674859cc20b1db3

SHA1
d6060f0989d6aea4b51f7dde439ca5a21fbc6639

SHA256
ebddf94172297bcf26fb6142f599de1facb43ab81e8fdf0d83fa79ad2f7ff5c8

SHA512
a753ff5121b2c64d473542bee51a90bb953e65879c9cd44812b4b0fd921aa7e19012341b05ccf6fd58c05c3f34715b671c6924526c165ba2aaf3804eb0b421b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8B0E.tmp\AutoInst.exe

Filesize
805KB

MD5
6709897005120aec5674859cc20b1db3

SHA1
d6060f0989d6aea4b51f7dde439ca5a21fbc6639

SHA256
ebddf94172297bcf26fb6142f599de1facb43ab81e8fdf0d83fa79ad2f7ff5c8

SHA512
a753ff5121b2c64d473542bee51a90bb953e65879c9cd44812b4b0fd921aa7e19012341b05ccf6fd58c05c3f34715b671c6924526c165ba2aaf3804eb0b421b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8B0E.tmp\AutoInst.ini

Filesize
161B

MD5
c541b88384d2691445a1eadb3d5cb741

SHA1
68e0b2dcea6718051637558982ed6479bf6f2fae

SHA256
4aa9d9874a06746af6c3cc97109bf5b9e52be081ec2b75c662c1aabaedc109a7

SHA512
aec6960a8e981acd4e84edf634efbf0b3fc3cfd4e0f05d94756447df2061db27f740d17c64e04a126232a228bee0a1b840c048f2d03200afd858bb31ee083f2a

Download Submit
memory/2728-132-0x0000000000000000-mapping.dmp

Download