a9362abacf731d794e89fd78a5a0c47e68713c180319cbb9d8a6042bbaa95100

Analysis

max time kernel
205s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2023, 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
Size

3.8MB
MD5

76142ae6bc689eb649429cdac475a0fc
SHA1

d8cdfdcc92477b552ebd53675df5b8c9261028fb
SHA256

a9362abacf731d794e89fd78a5a0c47e68713c180319cbb9d8a6042bbaa95100
SHA512

3255a36f76403700af979ddf07d950a6f1496f071fb2a13adfb7627961dafd0d43df3fb425bb68a10ad2ad32192b2bb5e4699de56086f9902992005c798da453
SSDEEP

49152:Wx211wH2PLA5SSRLRG/nMPEZEHyTM7wdOYv:e2EH2Db67wAy

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nottepad.exe	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nottepad.exe	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe

Executes dropped EXE 1 IoCs

pid	Process
1236	nod42.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\J:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\Q:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\S:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\B:	nod42.exe
File opened (read-only)	\??\B:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\Z:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\A:	nod42.exe
File opened (read-only)	\??\E:	nod42.exe
File opened (read-only)	\??\L:	nod42.exe
File opened (read-only)	\??\U:	nod42.exe
File opened (read-only)	\??\N:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\O:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\P:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\R:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\U:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\X:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\G:	nod42.exe
File opened (read-only)	\??\H:	nod42.exe
File opened (read-only)	\??\K:	nod42.exe
File opened (read-only)	\??\N:	nod42.exe
File opened (read-only)	\??\Q:	nod42.exe
File opened (read-only)	\??\F:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\L:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\M:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\T:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\S:	nod42.exe
File opened (read-only)	\??\A:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\G:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\K:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\F:	nod42.exe
File opened (read-only)	\??\O:	nod42.exe
File opened (read-only)	\??\P:	nod42.exe
File opened (read-only)	\??\R:	nod42.exe
File opened (read-only)	\??\W:	nod42.exe
File opened (read-only)	\??\J:	nod42.exe
File opened (read-only)	\??\M:	nod42.exe
File opened (read-only)	\??\Z:	nod42.exe
File opened (read-only)	\??\E:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\W:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\Y:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\T:	nod42.exe
File opened (read-only)	\??\V:	nod42.exe
File opened (read-only)	\??\X:	nod42.exe
File opened (read-only)	\??\I:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\V:	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
File opened (read-only)	\??\I:	nod42.exe
File opened (read-only)	\??\Y:	nod42.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1236	3568	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe	79
PID 3568 wrote to memory of 1236	3568	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe	79
PID 3568 wrote to memory of 1236	3568	d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe	79

C:\Users\Admin\AppData\Local\Temp\d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe
"C:\Users\Admin\AppData\Local\Temp\d8cdfdcc92477b552ebd53675df5b8c9261028fb.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\Documen\nod42.exe
  "C:\Users\Admin\Documen\nod42.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  PID:1236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documen\nod42.exe

Filesize
3.8MB

MD5
76142ae6bc689eb649429cdac475a0fc

SHA1
d8cdfdcc92477b552ebd53675df5b8c9261028fb

SHA256
a9362abacf731d794e89fd78a5a0c47e68713c180319cbb9d8a6042bbaa95100

SHA512
3255a36f76403700af979ddf07d950a6f1496f071fb2a13adfb7627961dafd0d43df3fb425bb68a10ad2ad32192b2bb5e4699de56086f9902992005c798da453

Download Submit
C:\Users\Admin\Documen\nod42.exe

Filesize
3.8MB

MD5
76142ae6bc689eb649429cdac475a0fc

SHA1
d8cdfdcc92477b552ebd53675df5b8c9261028fb

SHA256
a9362abacf731d794e89fd78a5a0c47e68713c180319cbb9d8a6042bbaa95100

SHA512
3255a36f76403700af979ddf07d950a6f1496f071fb2a13adfb7627961dafd0d43df3fb425bb68a10ad2ad32192b2bb5e4699de56086f9902992005c798da453

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads