61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6

Analysis

max time kernel
85s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2023, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe
Size

277KB
MD5

48a9ee293b9dfa6111cb882d18419328
SHA1

ccbe82316259c25b4ed687f06b8ad3e813dd463b
SHA256

61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6
SHA512

1011d7214d710fe38c50c74f97d066b06ee82ab5b49db1ea44491e114b50e56d7ba352e4942ca9f6f3d8ad8661e86bc6a4e0ca2c2358ba1d5d54971488845113
SSDEEP

6144:4XzKdNY49u8rVMsFd7jLHu8DcG001netIN:na4AgjzvcG001DN

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe

Executes dropped EXE 2 IoCs

pid	Process
116	ITS SB App Switch.exe
3752	ITS SB App Switch.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3600-134-0x0000000000100000-0x00000000001A0000-memory.dmp	upx
behavioral1/memory/3600-147-0x0000000000100000-0x00000000001A0000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3600	61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe
3600	61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe
3600	61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe
3600	61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 116	3600	61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe	85
PID 3600 wrote to memory of 116	3600	61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe	85
PID 3600 wrote to memory of 116	3600	61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe	85
PID 3600 wrote to memory of 3752	3600	61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe	86
PID 3600 wrote to memory of 3752	3600	61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe	86
PID 3600 wrote to memory of 3752	3600	61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe	86

C:\Users\Admin\AppData\Local\Temp\61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe
"C:\Users\Admin\AppData\Local\Temp\61496c8a4aa2c21b16e99b9d4455b5c7a505b101c60318040562d3ec6fa3e0d6.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
  "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
  "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
  2⤵
  - Executes dropped EXE
  PID:3752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
memory/3600-134-0x0000000000100000-0x00000000001A0000-memory.dmp

Filesize
640KB

Download
memory/3600-147-0x0000000000100000-0x00000000001A0000-memory.dmp

Filesize
640KB

Download