79798cd455143c5f2a6f70b87bd3e7b05ce5f68ee39409da1b4480c1842f842e

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2023, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.7MB
Sample230327-r36bvsga3w
SHA256 79798cd455143c5f2a6f70b87bd3e7b05ce5f68ee39409da1b4480c1842f842e
MD5 8f9dd1bddf4d5f744a68ff41f2e66584
SHA1 85b60f054c2f86c71b494ed5c2db003ab4e8e731
SHA512 9d6272eb78943820aef3081ce1a63e9c75439f7238f14237c853faf36b9d848bcd1894d572e49498a6e795fd52f88de22d3908cc8e6e601fedafe724668d3902
SSDEEP 49152:VN8HBrq0eKtmrma5wB7Uzq+UVhsuAYfzgGele5wDUQ/Vh:P8H1qBYIzq+UVhsuAEYle5q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4876	notepad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4876	2456	file.exe	81
PID 2456 wrote to memory of 4876	2456	file.exe	81
PID 2456 wrote to memory of 4876	2456	file.exe	81

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\hwid.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hwid.ini

Path C:\hwid.ini
Size 44B
SHA256 f3d4676054e01c081237ccbd7ed2dd4f9ce164423fb64c9a1717b54f3cd0fba8
MD5 d9fe8ce733f3959622a7f7275d67e301
SHA1 89936b4c674ecee9cb1d38ea0ad165eac61e0e34
SHA512 ff577bec18c6172b695649e3ff0a03b9e0b89c4955537ab5b2e59c0f80b943953229eba3680028dae9ba2b6aa670b8035b4ef695c99a1d9ad90b4abfd9f62ec7
MD5 SHA1 SHA512

Submit Download