c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476

Analysis

max time kernel
188s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe
Size

95KB
MD5

5be4f80f98b3afc692b804018cda6702
SHA1

dd2c4b52512e6db057f560494fbaec5fc7cc1100
SHA256

c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476
SHA512

1f43de6b6667ecb380951e4774a1c902055a9a7fca49af411e662a389921d50e8c0ec8d77b2b6343799df01f4afb320888fdb792ae006d0dc0de71e27c3436b1
SSDEEP

1536:0T3KuCzqahhTbcG0yZnFi0Seu9+2aLWdaAQzqj3D7QpHoSp7wpvFIy:Rc0S/9wCdaxzqj3DEeSCpvFIy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3188	4832	c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe	83
PID 4832 wrote to memory of 3188	4832	c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe	83
PID 4832 wrote to memory of 3188	4832	c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe	83

C:\Users\Admin\AppData\Local\Temp\c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe
"C:\Users\Admin\AppData\Local\Temp\c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Qjv..bat" > nul 2> nul
  2⤵
  PID:3188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Qjv..bat

Filesize
274B

MD5
70cac3b53f9771afe9b59d1c2331221f

SHA1
e50ffda184ce573ac0bbce63e71f58ddf37caed4

SHA256
138fd6928f6eed3cc9586723a283ec9ef065506e0697a9e6d54092ac43ac327f

SHA512
b4dd384dce8bde273d91f750b06163f5cdc2a98706c80b64e2f66477f5923142f6e7a178fec7801fa754a037260b8b80ee4ea8cded20b5fcadcfeb02d1f62b38

Download Submit
memory/4832-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4832-134-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download