8eff8dc924fc02d3745778f3ef441bff0986b3e2a25bb50f4e9752e45732c45c

Analysis

max time kernel
109s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2023, 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eff8dc924fc02d3745778f3ef441bff0986b3e2a25bb50f4e9752e45732c45c.exe
Size

1.3MB
MD5

548b86e2888b39bea64df6f82b1e6d39
SHA1

08766076d68d8719f4cd51a97c8f03c5c116faee
SHA256

8eff8dc924fc02d3745778f3ef441bff0986b3e2a25bb50f4e9752e45732c45c
SHA512

ff50c04291f21df3aea0904b3795a3967290d15bff0b3e38b58f8f5b607cd1ddcff8f868a5e9361ee773575bf30658394031bb5597e1d06cc6d177ab9d611c73
SSDEEP

24576:I/XEXjJSFHUKkUFO5x0N92MW3spOwI5JSMD1T1FliaKV9N/VdY/R:I/oS98oN9Wsp1M1B+/VdY/R

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	8eff8dc924fc02d3745778f3ef441bff0986b3e2a25bb50f4e9752e45732c45c.exe

Loads dropped DLL 1 IoCs

pid	Process
1512	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 1512	4688	8eff8dc924fc02d3745778f3ef441bff0986b3e2a25bb50f4e9752e45732c45c.exe	86
PID 4688 wrote to memory of 1512	4688	8eff8dc924fc02d3745778f3ef441bff0986b3e2a25bb50f4e9752e45732c45c.exe	86
PID 4688 wrote to memory of 1512	4688	8eff8dc924fc02d3745778f3ef441bff0986b3e2a25bb50f4e9752e45732c45c.exe	86

C:\Users\Admin\AppData\Local\Temp\8eff8dc924fc02d3745778f3ef441bff0986b3e2a25bb50f4e9752e45732c45c.exe
"C:\Users\Admin\AppData\Local\Temp\8eff8dc924fc02d3745778f3ef441bff0986b3e2a25bb50f4e9752e45732c45c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" -Y .\Qb~_tobN.1
  2⤵
  - Loads dropped DLL
  PID:1512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Qb~_tobN.1

Filesize
1.1MB

MD5
061ca9ac83227433048551c8ba1c5e87

SHA1
c4b62c624b382f7387ee4ab9f99df7701de80bef

SHA256
57a722c79045580fe0e1640c87bcfb41f377b91a438613ac13c259f4ced24606

SHA512
10a2d3ce97a4e63285e551d3ed1f35fd6689c2f50964ce074301cdbcc56313800a210b556fd62a84bdf621bee87f0eef093007e56b5afd294ee43f56ee0f0696

Download Submit
C:\Users\Admin\AppData\Local\Temp\qb~_tobN.1

Filesize
1.1MB

MD5
061ca9ac83227433048551c8ba1c5e87

SHA1
c4b62c624b382f7387ee4ab9f99df7701de80bef

SHA256
57a722c79045580fe0e1640c87bcfb41f377b91a438613ac13c259f4ced24606

SHA512
10a2d3ce97a4e63285e551d3ed1f35fd6689c2f50964ce074301cdbcc56313800a210b556fd62a84bdf621bee87f0eef093007e56b5afd294ee43f56ee0f0696

Download Submit
memory/1512-137-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/1512-139-0x0000000000AD0000-0x0000000000AD6000-memory.dmp

Filesize
24KB

Download
memory/1512-140-0x0000000002B50000-0x0000000002C30000-memory.dmp

Filesize
896KB

Download
memory/1512-141-0x0000000002C30000-0x0000000002CF8000-memory.dmp

Filesize
800KB

Download
memory/1512-144-0x0000000002C30000-0x0000000002CF8000-memory.dmp

Filesize
800KB

Download
memory/1512-145-0x0000000002C30000-0x0000000002CF8000-memory.dmp

Filesize
800KB

Download