414be916335471c8b7877691f686ce2fbd6f3c59e5c51e1b8c8fadecd6a431d7

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2023 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

414be916335471c8b7877691f686ce2fbd6f3c59e5c51e1b8c8fadecd6a431d7.exe
Size

13.6MB
MD5

191dd25782fe672dae986d4923e4d89c
SHA1

34ab02f08b343ec56ed34fdacba64768ca7a3b17
SHA256

414be916335471c8b7877691f686ce2fbd6f3c59e5c51e1b8c8fadecd6a431d7
SHA512

c0075227856d8f21eade3d5556ef528e07569520b787075bc660cc536d847c2acbf6207055dcb53a3c18f85365667ab5d5fd1f5d0017c1727143692a483551eb
SSDEEP

393216:cm2KQEwNfdomvVR9s66v3/D2+qlbmPrwqBFZzvYNFx:N2KQEcVR9sPCjlbS8SrzvKFx

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	414be916335471c8b7877691f686ce2fbd6f3c59e5c51e1b8c8fadecd6a431d7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3844	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3768	414be916335471c8b7877691f686ce2fbd6f3c59e5c51e1b8c8fadecd6a431d7.exe
3768	414be916335471c8b7877691f686ce2fbd6f3c59e5c51e1b8c8fadecd6a431d7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 3844	3768	414be916335471c8b7877691f686ce2fbd6f3c59e5c51e1b8c8fadecd6a431d7.exe	88
PID 3768 wrote to memory of 3844	3768	414be916335471c8b7877691f686ce2fbd6f3c59e5c51e1b8c8fadecd6a431d7.exe	88
PID 3768 wrote to memory of 3844	3768	414be916335471c8b7877691f686ce2fbd6f3c59e5c51e1b8c8fadecd6a431d7.exe	88

C:\Users\Admin\AppData\Local\Temp\414be916335471c8b7877691f686ce2fbd6f3c59e5c51e1b8c8fadecd6a431d7.exe
"C:\Users\Admin\AppData\Local\Temp\414be916335471c8b7877691f686ce2fbd6f3c59e5c51e1b8c8fadecd6a431d7.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\hwid.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\hwid.ini

Filesize
44B

MD5
e6521cb7482d6d9a966babeb1295d455

SHA1
3cc45b254a51dd567fbf00abcfee9266407dcf79

SHA256
2d1afe831072bf79c81ae28c8bfcb10519c97664e443218892c4479228d3da33

SHA512
37fe3ef14a567c9f66b2c833f798b7c9010a8fe15c8af232528cd743cd85b80e6063189d4018f4b62071aea12d78b5acd3f38b2d671b316ea734cff9cf3b1ef1

Download Submit
memory/3768-133-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/3768-134-0x0000000000E90000-0x0000000002565000-memory.dmp

Filesize
22.8MB

Download