1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804

Analysis

max time kernel
62s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2023, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe
Size

2.0MB
MD5

db60d78516e1f61b534abc0218c29efe
SHA1

a9fe6d9f24526cdc27a052e521bd80c28e8b7e5a
SHA256

1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804
SHA512

53d64264ed84f5e8b9a7a27cded9c673fd6c50338b794120ead376f9042d50791cc170d12e29e71b28cad7ae990c3d9e3b01a183122b941c797c2b0dfda95c1d
SSDEEP

24576:H+MC3/eMDtcOQDY8r7dvW2CIF+MEk2waIamKDKaT5ioAl8cSIjflzK4gWNz6yhV/:H+xe+VAP9o1Yy0hl8cSsflvZJj0K

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4824	powershell.exe
4824	powershell.exe
4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe
4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe
4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe
4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe
4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe
4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe
4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe
4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe
4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe
4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	powershell.exe
Token: SeDebugPrivilege	4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4824	4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe	80
PID 4536 wrote to memory of 4824	4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe	80
PID 4536 wrote to memory of 4824	4536	1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe	80

C:\Users\Admin\AppData\Local\Temp\1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe
"C:\Users\Admin\AppData\Local\Temp\1da07ff2b1056ddc31c2fa6bb522b5dba68b41d6a9cbd637d0b08edbeee57804.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4536-141-0x0000000010300000-0x0000000010B87000-memory.dmp

Filesize
8.5MB

Download
memory/4536-146-0x0000000003662000-0x00000000037FC000-memory.dmp

Filesize
1.6MB

Download
memory/4536-145-0x00000000103C0000-0x000000001044D000-memory.dmp

Filesize
564KB

Download
memory/4536-144-0x00000000103C0000-0x000000001044D000-memory.dmp

Filesize
564KB

Download
memory/4536-143-0x0000000010300000-0x0000000010B87000-memory.dmp

Filesize
8.5MB

Download
memory/4536-142-0x0000000003662000-0x00000000037FC000-memory.dmp

Filesize
1.6MB

Download
memory/4824-135-0x0000000004F00000-0x0000000004F22000-memory.dmp

Filesize
136KB

Download
memory/4824-139-0x0000000007530000-0x0000000007BAA000-memory.dmp

Filesize
6.5MB

Download
memory/4824-140-0x00000000063D0000-0x00000000063EA000-memory.dmp

Filesize
104KB

Download
memory/4824-138-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

Filesize
120KB

Download
memory/4824-137-0x00000000058C0000-0x0000000005926000-memory.dmp

Filesize
408KB

Download
memory/4824-136-0x00000000057E0000-0x0000000005846000-memory.dmp

Filesize
408KB

Download
memory/4824-134-0x0000000005140000-0x0000000005768000-memory.dmp

Filesize
6.2MB

Download
memory/4824-133-0x00000000028E0000-0x0000000002916000-memory.dmp

Filesize
216KB

Download