2150c1d1e7e62dc6b0d05a47ccb29acb486516e2236cc97f90caceba0d2c0443

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2023, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2150c1d1e7e62dc6b0d05a47ccb29acb486516e2236cc97f90caceba0d2c0443.exe
Size

2.6MB
MD5

9cd61aa6d9f8546ee9a905821cba6025
SHA1

b3fc8560d62fa35128aecfb0d60ff1c1427ce6ed
SHA256

2150c1d1e7e62dc6b0d05a47ccb29acb486516e2236cc97f90caceba0d2c0443
SHA512

69782fe2292858990b545673b7aa9aa7ed28667ede23a1bbb5b3ec93c4389cc0dd11851835e5fd0b3b4383be84202c1ad37895f2faf36b5dcbc72d031867dfda
SSDEEP

49152:71LnvuND6JcUGsn4oLXNFCaUvpnm4S2LNvERA8CFJoaR/o:5rvuZtsRRcaUvpnmR2NvJ8KoO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	2150c1d1e7e62dc6b0d05a47ccb29acb486516e2236cc97f90caceba0d2c0443.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5004	notepad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 5004	1576	2150c1d1e7e62dc6b0d05a47ccb29acb486516e2236cc97f90caceba0d2c0443.exe	82
PID 1576 wrote to memory of 5004	1576	2150c1d1e7e62dc6b0d05a47ccb29acb486516e2236cc97f90caceba0d2c0443.exe	82
PID 1576 wrote to memory of 5004	1576	2150c1d1e7e62dc6b0d05a47ccb29acb486516e2236cc97f90caceba0d2c0443.exe	82

C:\Users\Admin\AppData\Local\Temp\2150c1d1e7e62dc6b0d05a47ccb29acb486516e2236cc97f90caceba0d2c0443.exe
"C:\Users\Admin\AppData\Local\Temp\2150c1d1e7e62dc6b0d05a47ccb29acb486516e2236cc97f90caceba0d2c0443.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\hwid.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\hwid.ini

Filesize
44B

MD5
e127e7f9a9ec2c5708517b9ef192efcd

SHA1
9dd16ecff9be4454c994ff2c33a0a1be1b72176a

SHA256
5e6cfda86593c413bbadc4f8eb040fc0ffd6e9078a20873a6fef637c2bb632a7

SHA512
f303d5035835b20bf747cdf326a867993d79d06156217b74feb7911a3cd904fe7daca901f1a33fc2ad6220980a35f52f6c97a0074c2efe2a4c812313f8395452

Download Submit