dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe
Size

95KB
MD5

dbe3cc87f75cc728fa2519786d555070
SHA1

d63c29bfcbd6b6889466e35ab76fa8b0ebafb50f
SHA256

dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a
SHA512

9584ab2d9445297260dbce624f3ec8b083e80c7fa453e579359dfc26f06870822b56394a6eb750e4188a32af70aabdf44be2868ed37b9f9a171df26f7263dc0a
SSDEEP

1536:kT3KuCzqahhTbcG0yZnFi0Seu9+2aLWdaAQzqj3D7QpHoSp7wpvFIy:hc0S/9wCdaxzqj3DEeSCpvFIy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 4492	716	dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe	83
PID 716 wrote to memory of 4492	716	dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe	83
PID 716 wrote to memory of 4492	716	dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe	83

C:\Users\Admin\AppData\Local\Temp\dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe
"C:\Users\Admin\AppData\Local\Temp\dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ibf..bat" > nul 2> nul
  2⤵
  PID:4492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ibf..bat

Filesize
274B

MD5
0fac24a10cd378ebb4f99794b813de74

SHA1
f1906b979e2ed1a785807d1a7b67727d6077b1da

SHA256
d8a9328e9c5c629b1912fe1453738dfc6a6b7b75e9dec894293e01f175e4472a

SHA512
84ca2f4dd53b1e1fadc2121cd9175902b4a7a7ef1ae6a5af95edf9ffdd113afe1b13661d69d8069116a2653309c715558c2fb3e63343d37e3910db45155191bb

Download Submit
memory/716-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/716-134-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download