9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952

Analysis

max time kernel
180s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe
Size

120KB
MD5

bd4d5e644dffe7d29ddfa27d56ce0994
SHA1

dbb861c29fbe6e042975990869d4c9c4989e9509
SHA256

9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952
SHA512

9680ac83e0cd90fe7ba34eb8be3ab28773cbb0559e92b9ac817beab7ade384f84887e2b8d55dc13d6c306b2646cd029f54d99d2e8360cf935419e3b03de8ef91
SSDEEP

3072:wkD9YQmSZ3k84l/5UGv7aXj1woCO827xLW:wkDzmSZXW/j7aXj1wBp27x6

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4368-132-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4748	4368	9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe	79
PID 4368 wrote to memory of 4748	4368	9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe	79
PID 4368 wrote to memory of 4748	4368	9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe	79

C:\Users\Admin\AppData\Local\Temp\9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe
"C:\Users\Admin\AppData\Local\Temp\9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Wmv..bat" > nul 2> nul
  2⤵
  PID:4748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wmv..bat

Filesize
274B

MD5
b62fd848be91507c72793f0106bfa426

SHA1
803f1c98b7de5a19a50d3686edf952219ecf7538

SHA256
838d3f65a8cddab2b98c2c90b0b2bfcd7617f5396ebec320c191b22823faf177

SHA512
18136b1b4da8ec0d2678f083a740063521bc37105f3b32156537ccc2cf9df963c81ab1b3276508e5c2c855404207dd4334c640f310d2c72f4489731c55ec9e3f

Download Submit
memory/4368-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4368-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4368-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download