Analysis

  • max time kernel
    209s
  • max time network
    235s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2022, 03:49

General

  • Target

    bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d.exe

  • Size

    113KB

  • MD5

    ef9965142656fa38bbe8c527c49c7fda

  • SHA1

    0e1f4067fbe7c70ed4c07ec90c211ceea5b7cded

  • SHA256

    bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d

  • SHA512

    9600b4c75ccefb03cbf2ff04eaeb5c60c00342dba782394a4484aaa7e598dce9b99c09c83384d7617f7dafb6d1b536ee92a8116ce45743b204707447b75724b0

  • SSDEEP

    3072:oirat2b/8fnrxMcfm7PHmzOOU+McCNXHFh:oZScOOOJ7cSX

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d.exe
    "C:\Users\Admin\AppData\Local\Temp\bc184c23b969905fd9a7918805a23762b321eb1fd4f3d810e32bff11dcaa7e5d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:4544
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Vsj..bat" > nul 2> nul
      2⤵
        PID:2344

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Vsj..bat

      Filesize

      274B

      MD5

      d810781d100464aa88929066733882ad

      SHA1

      fde6a28f414dcab8702fee12b9d885f69b0d79d0

      SHA256

      7d7814704dad948a306d2f270cc2d3b0211d3b2bd704d3d11d70c8e377c9c870

      SHA512

      90c61e2e79da9e7a06e8083f46c0b49002fc1c2823ed01cebb58e3e530d64298d6200caafa1615e5fc70b48a19f086646ec1302306279118b32cdc3f8a7997b2

    • memory/4544-132-0x00000000005C0000-0x00000000005CC000-memory.dmp

      Filesize

      48KB

    • memory/4544-133-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/4544-134-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/4544-136-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB