78d137ca381a4a8e1412b52f4706006e61b2abcef87fae0b296f0200b0af9eed

Analysis

max time kernel
143s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2023, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

36KB
MD5

da72c93960a58f7fc95220cd8428b548
SHA1

13c7caecb86f0e8de13dabbc612beba98241909b
SHA256

78d137ca381a4a8e1412b52f4706006e61b2abcef87fae0b296f0200b0af9eed
SHA512

da32d5770b647e8fbee4b069378c0c730ab98bcc77405850ea874c3890be43db1862d2328cedcb64edc9b360823ecdb35cda5d2b1029dd1a31f3c833329f20b2
SSDEEP

384:BijEOALCtPQNH8Ry3s+OhsqZ57I4z48nh5bJxsX9/dikytQ7IZh5Msn0JSOJ53en:BnOmPsOqok4CfA38QOXn0FPuZstk3j3

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	tmp.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1148-137-0x0000000140000000-0x000000014001B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1772	1148	tmp.exe	85
PID 1148 wrote to memory of 1772	1148	tmp.exe	85

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\65E3.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\tmp.exe""
  2⤵
  PID:1772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\65E3.tmp\1.bat

Filesize
86B

MD5
8cb8e8a4e65e88be49157c9a4da5a0f8

SHA1
a9899503ff3ac7dc757eccab13e9337068e58137

SHA256
9a1007e370f4adc38f341f07b4b0381b68f86c745159b37ab108dbcc80b1e61d

SHA512
9dc2ad4a2c7eff62565b6418441cd286fef67049d7ce48e1ce3290d355bc88468d56ad5866e7ce41e0a7ffe45580da88d620b87b707e1edf9eb6ad7227d3ac13

Download Submit
memory/1148-137-0x0000000140000000-0x000000014001B000-memory.dmp

Filesize
108KB

Download