5c5c3747d7ace4b8a38568fecc6e1da7acec0e365ee78ff885470356ad5ea1da

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2023, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fd90fe5fb7e102df4418b85bccd15b5.exe
Size 2.6MB
Sample230113-va4jcaed3s
SHA256 5c5c3747d7ace4b8a38568fecc6e1da7acec0e365ee78ff885470356ad5ea1da
MD5 4fd90fe5fb7e102df4418b85bccd15b5
SHA1 0890ff66f17f0b41f59dc9e53369ed88ca8318ed
SHA512 1bbdad274643feb1fe008b1d51e0427a31c3ba5a19981b832bb06f8fac02f0c36d6f35915585545173e2adbf3cc3d1e24ceca10aed5736c48a1ed9215e95ccdb
SSDEEP 49152:kdLvvuND6JcUu0XYoLXN16aUvpnmgieLt/EhA8nFJ5QVa/o:eDvuZF0BRkaUvpnmJet/J8b5Q4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	4fd90fe5fb7e102df4418b85bccd15b5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1748	notepad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1748	1140	4fd90fe5fb7e102df4418b85bccd15b5.exe	84
PID 1140 wrote to memory of 1748	1140	4fd90fe5fb7e102df4418b85bccd15b5.exe	84
PID 1140 wrote to memory of 1748	1140	4fd90fe5fb7e102df4418b85bccd15b5.exe	84

C:\Users\Admin\AppData\Local\Temp\4fd90fe5fb7e102df4418b85bccd15b5.exe
"C:\Users\Admin\AppData\Local\Temp\4fd90fe5fb7e102df4418b85bccd15b5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\hwid.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hwid.ini

Path C:\hwid.ini
Size 44B
SHA256 785506ccf9c062fdd1697bfeab73a842c62d9abcce1697795d9f2b1e27ee6e63
MD5 027dc26b1094ff2aca2e20495af7ab6f
SHA1 3666572564132afe19865dbbc9db9323d802a910
SHA512 be6d3de35e3706910e3e80fe20deaeddef172e34594b153cf36b537e1d00c5f2fc3fea28420de29f0b5f6338ece6a6737389ea285fe15bde53bd521c159932c3
MD5 SHA1 SHA512

Submit Download