be7331dd3b9faf80763ec2f18febca7a0ec296b7c97384d753ed6c74d0969fc7

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2023, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a8b6f8cb475573b90e11a72e4670476.exe
Size 2.6MB
Sample230102-jqdr3sdf79
SHA256 be7331dd3b9faf80763ec2f18febca7a0ec296b7c97384d753ed6c74d0969fc7
MD5 4a8b6f8cb475573b90e11a72e4670476
SHA1 d7a29005694e0b388e9e665550df934a14485066
SHA512 6a7f712bbbce0da4a5020790bea28860325f372bcad8fdce9d51a33c33b822dd657300863a5dac85d5c57ffe1a466f8fb2be4e82290ac00219ab757ea42fc83e
SSDEEP 49152:sb34dHpTJgRBHVcyaSPNVssisGOk4LQkSJf6RhrZKa:s3oECDSPNVssisGOZQ7fK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	4a8b6f8cb475573b90e11a72e4670476.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4720	notepad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4720	400	4a8b6f8cb475573b90e11a72e4670476.exe	82
PID 400 wrote to memory of 4720	400	4a8b6f8cb475573b90e11a72e4670476.exe	82
PID 400 wrote to memory of 4720	400	4a8b6f8cb475573b90e11a72e4670476.exe	82

C:\Users\Admin\AppData\Local\Temp\4a8b6f8cb475573b90e11a72e4670476.exe
"C:\Users\Admin\AppData\Local\Temp\4a8b6f8cb475573b90e11a72e4670476.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\hwid.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hwid.ini

Path C:\hwid.ini
Size 44B
SHA256 d69432ebe0064f0e367abd85dbea37bbc7344cf34f7f1b0254f139b4c8f2755f
MD5 e2e64d3c0783eeb0f9fe4d7b9d62c058
SHA1 fd186123ca61a0ee5de1bbb21998457b7b5fcdbc
SHA512 fc608408109d04889566a356fce505ffa3c72c1802a0dbf2aa59bc8d54e3b9de9d5eda024c6b829d8e337981bc02f8124ebd1df82c8568741f510b22e3f50474
MD5 SHA1 SHA512

Submit Download