8b65240ab4b290785dc4433c16ab85ed62847f17a0eda89db58344d26cf76b4e

Analysis

max time kernel
84s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2023, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc42a7babac07fa67c213c29cf9e8edf.exe
Size 10.3MB
Sample230213-ajbvgagh3w
SHA256 8b65240ab4b290785dc4433c16ab85ed62847f17a0eda89db58344d26cf76b4e
MD5 bc42a7babac07fa67c213c29cf9e8edf
SHA1 d896bcbe4e75ee3af67e03a24fb638617857bbed
SHA512 23733c4ad9a1d68c1efb8ec444b1ed772dd09cedb0549ca6bfe4f8a43736d433a7988c41dfc848e304fda3e75c409c0df43b70cc1781eeeab84a58b87f6dcd8a
SSDEEP 196608:itPpaOqyCQAuAANu5+j6E6TRH2YguNuoY4XCyEDTzQWkc8LBh7u:8PHdCQAiEcjdPusb4X6/t4X7u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	bc42a7babac07fa67c213c29cf9e8edf.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\temaqua.url	bc42a7babac07fa67c213c29cf9e8edf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\temaqua.url	bc42a7babac07fa67c213c29cf9e8edf.exe

Executes dropped EXE 1 IoCs

pid	Process
1176	visegame.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4972	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2732	bc42a7babac07fa67c213c29cf9e8edf.exe
2732	bc42a7babac07fa67c213c29cf9e8edf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 1176	2732	bc42a7babac07fa67c213c29cf9e8edf.exe	91
PID 2732 wrote to memory of 1176	2732	bc42a7babac07fa67c213c29cf9e8edf.exe	91
PID 2732 wrote to memory of 1176	2732	bc42a7babac07fa67c213c29cf9e8edf.exe	91
PID 2732 wrote to memory of 4736	2732	bc42a7babac07fa67c213c29cf9e8edf.exe	92
PID 2732 wrote to memory of 4736	2732	bc42a7babac07fa67c213c29cf9e8edf.exe	92
PID 2732 wrote to memory of 4736	2732	bc42a7babac07fa67c213c29cf9e8edf.exe	92
PID 4736 wrote to memory of 4972	4736	cmd.exe	94
PID 4736 wrote to memory of 4972	4736	cmd.exe	94
PID 4736 wrote to memory of 4972	4736	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\bc42a7babac07fa67c213c29cf9e8edf.exe
"C:\Users\Admin\AppData\Local\Temp\bc42a7babac07fa67c213c29cf9e8edf.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2732
- C:\ProgramData\yegihaga\visegame.exe
  "C:\ProgramData\yegihaga\visegame.exe"
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c @echo off & ping 127.0.0.1 -n 5 -w 1000 > nul & del "C:\Users\Admin\AppData\Local\Temp\bc42a7babac07fa67c213c29cf9e8edf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5 -w 1000
    3⤵
    - Runs ping.exe
    PID:4972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

visegame.exe

Path C:\ProgramData\yegihaga\visegame.exe
Size 561.9MB
SHA256 3b08f887fea983f65c4925ebbaa1212bfaa963880f783bca0af339b678835bae
MD5 66026bbcc96a6e05d9b3ec805b93d61a
SHA1 d158958bb74625cd288174f8bff9fe3e2ea284e5
SHA512 4a6cde900b117efe76298972b6057644baaa90652ae6580f1496d6b10ec2c3d6e53c34bf659191345dedfe8b1a3b8147a5281dce58eadbd1604d0fed5440db4d
SSDEEP 196608:itPpaOqyCQAuAANu5+j6E6TRH2YguNuoY4XCyEDTzQWkc8LBh7:8PHdCQAiEcjdPusb4X6/t4X7
MD5 SHA1 SHA512 SSDEEP

Submit Download

visegame.exe

Path C:\ProgramData\yegihaga\visegame.exe
Size 564.1MB
SHA256 85271c066aaa3cdefc0b64b5cd3e271643a4b69a18c7df29109f432a244b4eab
MD5 a7a404e54521683e9e0a0d299710812f
SHA1 9ee62d6f2702c914674da3560b0332babb175c20
SHA512 d03a16ae0e38394aa87bbd7650ad21fa39c17d5feb208eb672ff833c4291c0622fa0d8e090e6d637ef4d3b1e8513b6163e0897c4a0e568fe4b7a7d537f5827a7
SSDEEP 196608:itPpaOqyCQAuAANu5+j6E6TRH2YguNuoY4XCyEDTzQWkc8LBh7:8PHdCQAiEcjdPusb4X6/t4X7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2732-132-0x0000000000400000-0x00000000017DB000-memory.dmp

Download

memory/2732-133-0x0000000000400000-0x00000000017DB000-memory.dmp

Download

memory/2732-137-0x00000000039F1000-0x00000000039FB000-memory.dmp

Download

memory/2732-142-0x0000000000400000-0x00000000017DB000-memory.dmp

Download