5a9cbf6ce9beaa771b9c59a76573c1954ebcdf02aa31ecf161081a27302eee4a

Analysis

max time kernel
91s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2022, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a9cbf6ce9beaa771b9c59a76573c1954ebcdf02aa31ecf161081a27302eee4a.exe
Size

1.6MB
MD5

3a4e11c08616a3ff092252247319fc69
SHA1

5f2c09aee73a06de21712bc3c500cd79bac372ee
SHA256

5a9cbf6ce9beaa771b9c59a76573c1954ebcdf02aa31ecf161081a27302eee4a
SHA512

9c0b098190614c2896d43530551c3853dbfd9d7ad075c00840b046ad1effc87af556bdd1b84f1083da95171d98f787acdb3dd1a998043196bf1e6a36adb8efa0
SSDEEP

24576:U2G/nvxW3Ww0tneqH2yGWbn7LJeRyakviWz01DBeZiLyCdjwCYbMrOZVYCHmY00Z:UbA30neK5GUnGkv41DB0CJw3gr2KCcyB

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	5a9cbf6ce9beaa771b9c59a76573c1954ebcdf02aa31ecf161081a27302eee4a.exe

Loads dropped DLL 2 IoCs

pid	Process
1204	msiexec.exe
1204	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 1204	4544	5a9cbf6ce9beaa771b9c59a76573c1954ebcdf02aa31ecf161081a27302eee4a.exe	80
PID 4544 wrote to memory of 1204	4544	5a9cbf6ce9beaa771b9c59a76573c1954ebcdf02aa31ecf161081a27302eee4a.exe	80
PID 4544 wrote to memory of 1204	4544	5a9cbf6ce9beaa771b9c59a76573c1954ebcdf02aa31ecf161081a27302eee4a.exe	80

C:\Users\Admin\AppData\Local\Temp\5a9cbf6ce9beaa771b9c59a76573c1954ebcdf02aa31ecf161081a27302eee4a.exe
"C:\Users\Admin\AppData\Local\Temp\5a9cbf6ce9beaa771b9c59a76573c1954ebcdf02aa31ecf161081a27302eee4a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /y .\JKXD.TK
  2⤵
  - Loads dropped DLL
  PID:1204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JKXD.TK

Filesize
1.5MB

MD5
91f53769ce7683539c24dbee102808b1

SHA1
4a6e5916446476ec8e8aeab14cd9b8bae252f981

SHA256
3e1a99a3db505aff6d1bd9e7d38016b0b5b8db4170b6e3c8b7876c9f67552ebe

SHA512
e043c23ed30d3c0bf2fccda4ee4a8f5f5c58535b072c3f030e64e8bec851e3ce47b5af2cee5e3e33cc364bb80ca84e33cbfa47c49cd337920369734a0ec772a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\JKXd.TK

Filesize
1.5MB

MD5
91f53769ce7683539c24dbee102808b1

SHA1
4a6e5916446476ec8e8aeab14cd9b8bae252f981

SHA256
3e1a99a3db505aff6d1bd9e7d38016b0b5b8db4170b6e3c8b7876c9f67552ebe

SHA512
e043c23ed30d3c0bf2fccda4ee4a8f5f5c58535b072c3f030e64e8bec851e3ce47b5af2cee5e3e33cc364bb80ca84e33cbfa47c49cd337920369734a0ec772a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\JKXd.TK

Filesize
1.5MB

MD5
91f53769ce7683539c24dbee102808b1

SHA1
4a6e5916446476ec8e8aeab14cd9b8bae252f981

SHA256
3e1a99a3db505aff6d1bd9e7d38016b0b5b8db4170b6e3c8b7876c9f67552ebe

SHA512
e043c23ed30d3c0bf2fccda4ee4a8f5f5c58535b072c3f030e64e8bec851e3ce47b5af2cee5e3e33cc364bb80ca84e33cbfa47c49cd337920369734a0ec772a7

Download Submit
memory/1204-136-0x0000000003230000-0x00000000033AB000-memory.dmp

Filesize
1.5MB

Download
memory/1204-137-0x00000000034B0000-0x00000000035AD000-memory.dmp

Filesize
1012KB

Download
memory/1204-138-0x00000000036B0000-0x00000000037AB000-memory.dmp

Filesize
1004KB

Download
memory/1204-139-0x00000000037B0000-0x0000000003881000-memory.dmp

Filesize
836KB

Download
memory/1204-140-0x0000000003890000-0x000000000394B000-memory.dmp

Filesize
748KB

Download
memory/1204-141-0x0000000003890000-0x000000000394B000-memory.dmp

Filesize
748KB

Download
memory/1204-143-0x00000000036B0000-0x00000000037AB000-memory.dmp

Filesize
1004KB

Download