707e4c6d5d57fe10d244fd24f57943ac4bd01f575cafa82dcacba9ce1ca6700e

Analysis

max time kernel
69s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NodeBeamEditor/bin/html/css/bootstrap.min.css
Size

114KB
MD5

eedf9ee80c2faa4e1b9ab9017cdfcb88
SHA1

ed29315e0ffb3f14382431f2724235bf67f44eb3
SHA256

f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5
SHA512

ff9296270da6bcc3b664ce5f9dd5715109a954fa9ac59c9845332b5edae9aecc90db3334a3434c8d4d3623c6495de04fb6b9ab3cee0803208246cc9d1b4049a1
SSDEEP

768:byzGxw/jyBQWlJxtQDINHHlgmqITm8qAdwFKbv2ctBDI35UPyu8psYvS1Ft:/w/GLiINHHlgmC8p5b5ZPUpE

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
400	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 400	1508	cmd.exe	85
PID 1508 wrote to memory of 400	1508	cmd.exe	85

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NodeBeamEditor\bin\html\css\bootstrap.min.css
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\NodeBeamEditor\bin\html\css\bootstrap.min.css
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...