e8d56aa67281d59cab2caffce6783301e4d724f69a32c92e2eab10e5bd63d657

Analysis

max time kernel
204s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e8d56aa67281d59cab2caffce6783301e4d724f69a32c92e2eab10e5bd63d657.exe
Size

82KB
MD5

75fdf3fc65f793a6bbaba766d5b6585f
SHA1

a61071106eb067b1bc1e743fa2de2b7b0e77f0e6
SHA256

e8d56aa67281d59cab2caffce6783301e4d724f69a32c92e2eab10e5bd63d657
SHA512

b26aa1801a764c2720ac0a0fd19a7b6d047bfbc3deec8cdeaa0c0a6e1791c43188712926def2b54301affa1c71965b6a716c56eb1b7fb13ccaef9d76eae9177c
SSDEEP

1536:qm69n24x1XDhknp0YrPnkc04TJL9h4cSanIqLDXujxvUJ:u924jDhkpRrPkc04TJ5hRIqLDXulcJ

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	e8d56aa67281d59cab2caffce6783301e4d724f69a32c92e2eab10e5bd63d657.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3320	e8d56aa67281d59cab2caffce6783301e4d724f69a32c92e2eab10e5bd63d657.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 220	3320	e8d56aa67281d59cab2caffce6783301e4d724f69a32c92e2eab10e5bd63d657.exe	82
PID 3320 wrote to memory of 220	3320	e8d56aa67281d59cab2caffce6783301e4d724f69a32c92e2eab10e5bd63d657.exe	82
PID 3320 wrote to memory of 220	3320	e8d56aa67281d59cab2caffce6783301e4d724f69a32c92e2eab10e5bd63d657.exe	82

C:\Users\Admin\AppData\Local\Temp\e8d56aa67281d59cab2caffce6783301e4d724f69a32c92e2eab10e5bd63d657.exe
"C:\Users\Admin\AppData\Local\Temp\e8d56aa67281d59cab2caffce6783301e4d724f69a32c92e2eab10e5bd63d657.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Adv..bat" > nul 2> nul
  2⤵
  PID:220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Adv..bat

Filesize
274B

MD5
490a4ee5ca9bf8a81d29854517c3ae54

SHA1
d74fd029eb2bdd752a412b2b9eddd24f9fa0a885

SHA256
00287f4f116ff0138e72e63922fbc7fee28662559a26c23ac7111c9f74609066

SHA512
69e816966df0879223c242ecee4dcb51cdb15f9d3286977cc93017a30963834124f637b566e4213dbd5483cd097db6867967f8d33843015f22829e68fbbb9e5a

Download Submit
memory/3320-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3320-133-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3320-135-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download