4cc1fc4c8bc219e3363496e61d30814dd021009d0dad5e67edb6e59225a0721a

Analysis

max time kernel
91s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2023, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4cc1fc4c8bc219e3363496e61d30814dd021009d0dad5e67edb6e59225a0721a.exe
Size

17.7MB
MD5

621a88f433cefd7133f668503b7d2271
SHA1

251a05560f6184141266ec7714ac77cfec5974f3
SHA256

4cc1fc4c8bc219e3363496e61d30814dd021009d0dad5e67edb6e59225a0721a
SHA512

5575658031b03a11b2e826f0cc41a56d76d68cfbaf262803749dfe36aa91dc695de63499e8b083c4a5f3dc7ae384ccfb585e543edb618759852e943c5b5e30de
SSDEEP

393216:UI/R9tWn0zP217jzCRWChPeQoWMt4R9vWn0zP2/7Gv9pbc:zp9M0zKu5roWiu9q0zQe9xc

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4216	Autorun.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	4cc1fc4c8bc219e3363496e61d30814dd021009d0dad5e67edb6e59225a0721a.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\DV_PC_PLUS8\AUTORUN.INF	4cc1fc4c8bc219e3363496e61d30814dd021009d0dad5e67edb6e59225a0721a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4216	Autorun.exe
4216	Autorun.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4216	3556	4cc1fc4c8bc219e3363496e61d30814dd021009d0dad5e67edb6e59225a0721a.exe	85
PID 3556 wrote to memory of 4216	3556	4cc1fc4c8bc219e3363496e61d30814dd021009d0dad5e67edb6e59225a0721a.exe	85
PID 3556 wrote to memory of 4216	3556	4cc1fc4c8bc219e3363496e61d30814dd021009d0dad5e67edb6e59225a0721a.exe	85

C:\Users\Admin\AppData\Local\Temp\4cc1fc4c8bc219e3363496e61d30814dd021009d0dad5e67edb6e59225a0721a.exe
"C:\Users\Admin\AppData\Local\Temp\4cc1fc4c8bc219e3363496e61d30814dd021009d0dad5e67edb6e59225a0721a.exe"
1⤵
- Checks computer location settings
- Drops autorun.inf file
- Suspicious use of WriteProcessMemory
PID:3556
- C:\DV_PC_PLUS8\Autorun.exe
  "C:\DV_PC_PLUS8\Autorun.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DV_PC_PLUS8\Autorun.exe

Filesize
1.0MB

MD5
516d4ae90039b55899eaf818f6246566

SHA1
8801fbd4bd4a02735c790698f8edd8c68435d0e7

SHA256
29afc5e24c91b8094f3392c88b19bbc2ebe5569ea43e051672b5b0d2879f4e19

SHA512
f14e4ad22506498262b84df572d96315667b3e286e471c158fc5b1897ac21869773b51dba1e400857cbfcfc57c8aad031879852b43a371f530f44010c00ef48a

Download Submit
C:\DV_PC_PLUS8\Autorun.exe

Filesize
1.0MB

MD5
516d4ae90039b55899eaf818f6246566

SHA1
8801fbd4bd4a02735c790698f8edd8c68435d0e7

SHA256
29afc5e24c91b8094f3392c88b19bbc2ebe5569ea43e051672b5b0d2879f4e19

SHA512
f14e4ad22506498262b84df572d96315667b3e286e471c158fc5b1897ac21869773b51dba1e400857cbfcfc57c8aad031879852b43a371f530f44010c00ef48a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads