df1ef894696019205b3501bdabc102605171c2c4c97f97c61b3fc9e7e953a795

Analysis

max time kernel
149s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2023, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

df1ef894696019205b3501bdabc102605171c2c4c97f97c61b3fc9e7e953a795.exe
Size

5.2MB
MD5

7ecc99cf7d509ba901d6e6dab9c5d4d9
SHA1

361f41f5c404f932e646277fa30875a136f319d6
SHA256

df1ef894696019205b3501bdabc102605171c2c4c97f97c61b3fc9e7e953a795
SHA512

757ebbc86c6897d8ed82364919c8d7043c6d0cef3cb9c52670415b598dee9f1d348f690f191c638e66cbaa11230d1b6de25e1f5f4d8677fb5dd013db78023097
SSDEEP

98304:Cr++oHvHA1Ow6xA4wgB/gXEtfZQQLRO/o0DX3kW3+6SXmovC9kJIUfqfzc7n:Cr+XPg1Ow6pB/+SBQQI/bXJnovCaq5

Score

7^/10

vmprotect

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	df1ef894696019205b3501bdabc102605171c2c4c97f97c61b3fc9e7e953a795.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/4980-133-0x00000000001E0000-0x0000000000AD8000-memory.dmp	vmprotect
behavioral1/memory/4980-134-0x00000000001E0000-0x0000000000AD8000-memory.dmp	vmprotect
behavioral1/memory/4980-138-0x00000000001E0000-0x0000000000AD8000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3396	notepad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3396	4980	df1ef894696019205b3501bdabc102605171c2c4c97f97c61b3fc9e7e953a795.exe	80
PID 4980 wrote to memory of 3396	4980	df1ef894696019205b3501bdabc102605171c2c4c97f97c61b3fc9e7e953a795.exe	80
PID 4980 wrote to memory of 3396	4980	df1ef894696019205b3501bdabc102605171c2c4c97f97c61b3fc9e7e953a795.exe	80

C:\Users\Admin\AppData\Local\Temp\df1ef894696019205b3501bdabc102605171c2c4c97f97c61b3fc9e7e953a795.exe
"C:\Users\Admin\AppData\Local\Temp\df1ef894696019205b3501bdabc102605171c2c4c97f97c61b3fc9e7e953a795.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\hwid.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\hwid.ini

Filesize
44B

MD5
c40fb241ac9ec5413dd8c89ffb103423

SHA1
4a62c2453b05e0d40a42a4223d236564146f4e77

SHA256
dc68474f6c777fe7a33c9fc47b333a1ddff0f934b5895cbd5b68505f6dfbc84d

SHA512
95be3b4432481ee73911a347bfe98f4677999a85e2f4cecef73d97ee52ae044493c5ff0197e91dbc3a84e8ea4514ea8ededa3b2cf473399d8878152b01714f76

Download Submit
memory/4980-133-0x00000000001E0000-0x0000000000AD8000-memory.dmp

Filesize
9.0MB

Download
memory/4980-134-0x00000000001E0000-0x0000000000AD8000-memory.dmp

Filesize
9.0MB

Download
memory/4980-138-0x00000000001E0000-0x0000000000AD8000-memory.dmp

Filesize
9.0MB

Download