e726071ce6577e656c0b7bcc5d76dc53200d621448fe1e3504584eebce7c83d1

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2023 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e726071ce6577e656c0b7bcc5d76dc53200d621448fe1e3504584eebce7c83d1.exe
Size

1.8MB
MD5

f34edfe30a2a5cd9f66cb7ca186e26ca
SHA1

ab2ceb3871c0ef6a55f36c4beff4d924b01ab950
SHA256

e726071ce6577e656c0b7bcc5d76dc53200d621448fe1e3504584eebce7c83d1
SHA512

23bfa92ec59c57820e066688200c70e63cbad2ff6afce48a485b92f5a719f80618fe5c3b18463fed5e81691060aef6794b109f7faaa9b8d9f7ad6b61d4104149
SSDEEP

49152:OCWhF7BfJXAEsLMSUzuaEqphsA58Z0cLpeMrLY0cONP3vBQoPcb:OCWhF7BfKEY3UzuDqphaJppY0c2CwG

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	e726071ce6577e656c0b7bcc5d76dc53200d621448fe1e3504584eebce7c83d1.exe

Loads dropped DLL 2 IoCs

pid	Process
3452	msiexec.exe
3452	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3452	4484	e726071ce6577e656c0b7bcc5d76dc53200d621448fe1e3504584eebce7c83d1.exe	84
PID 4484 wrote to memory of 3452	4484	e726071ce6577e656c0b7bcc5d76dc53200d621448fe1e3504584eebce7c83d1.exe	84
PID 4484 wrote to memory of 3452	4484	e726071ce6577e656c0b7bcc5d76dc53200d621448fe1e3504584eebce7c83d1.exe	84

C:\Users\Admin\AppData\Local\Temp\e726071ce6577e656c0b7bcc5d76dc53200d621448fe1e3504584eebce7c83d1.exe
"C:\Users\Admin\AppData\Local\Temp\e726071ce6577e656c0b7bcc5d76dc53200d621448fe1e3504584eebce7c83d1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" -Y .\4RS5IRA.TM7
  2⤵
  - Loads dropped DLL
  PID:3452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4RS5IRA.TM7

Filesize
1.1MB

MD5
42f22bc83d191897a07fa111618071c4

SHA1
52f2be8e1a7ded03fb05f0c49871df58b70f9d6a

SHA256
ac4316d1cbe434a6a107590b85446f51605a4d1935a317df7f7799971c4c5711

SHA512
b7763a57efd186c87df875779e0d14070ce47bbb6e8fde3e46a6d7deceec326cb0a32f86d6ddc7f97c7272fd8f4f40c0ba0ccb05232f4554cac96bf2eb2dba55

Download Submit
C:\Users\Admin\AppData\Local\Temp\4rS5ira.tm7

Filesize
1.1MB

MD5
42f22bc83d191897a07fa111618071c4

SHA1
52f2be8e1a7ded03fb05f0c49871df58b70f9d6a

SHA256
ac4316d1cbe434a6a107590b85446f51605a4d1935a317df7f7799971c4c5711

SHA512
b7763a57efd186c87df875779e0d14070ce47bbb6e8fde3e46a6d7deceec326cb0a32f86d6ddc7f97c7272fd8f4f40c0ba0ccb05232f4554cac96bf2eb2dba55

Download Submit
C:\Users\Admin\AppData\Local\Temp\4rS5ira.tm7

Filesize
1.1MB

MD5
42f22bc83d191897a07fa111618071c4

SHA1
52f2be8e1a7ded03fb05f0c49871df58b70f9d6a

SHA256
ac4316d1cbe434a6a107590b85446f51605a4d1935a317df7f7799971c4c5711

SHA512
b7763a57efd186c87df875779e0d14070ce47bbb6e8fde3e46a6d7deceec326cb0a32f86d6ddc7f97c7272fd8f4f40c0ba0ccb05232f4554cac96bf2eb2dba55

Download Submit
memory/3452-138-0x00000000008B0000-0x00000000009D6000-memory.dmp

Filesize
1.1MB

Download
memory/3452-139-0x00000000008B0000-0x00000000009D6000-memory.dmp

Filesize
1.1MB

Download
memory/3452-141-0x0000000000790000-0x0000000000796000-memory.dmp

Filesize
24KB

Download
memory/3452-143-0x0000000002860000-0x0000000002960000-memory.dmp

Filesize
1024KB

Download
memory/3452-144-0x0000000002960000-0x0000000002A47000-memory.dmp

Filesize
924KB

Download
memory/3452-147-0x0000000002960000-0x0000000002A47000-memory.dmp

Filesize
924KB

Download
memory/3452-148-0x0000000002960000-0x0000000002A47000-memory.dmp

Filesize
924KB

Download