5bedafcfaa5dc73345436757416cbe89977ef6b4509da7cdb235d8b0b67163c8

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2023 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bedafcfaa5dc73345436757416cbe89977ef6b4509da7cdb235d8b0b67163c8.exe
Size

3.1MB
MD5

21deedf8e08d0be694f3fdb4c25b5391
SHA1

9b6a23f798cab1cd8bce04cf084c06abd52f7d46
SHA256

5bedafcfaa5dc73345436757416cbe89977ef6b4509da7cdb235d8b0b67163c8
SHA512

db36bc2e3dbc845bea8df797a2f499c6e929965f6584e0697be2459f03a3e78643ff130f23e67c98702332bec4e9fdc467c7170b8be80e59641f193233557260
SSDEEP

98304:iO25XckfEZ6FmkeM1oKvFvYi2HdA9igeZ7DRBDRsb:7kf26FmMWeqrE

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	5bedafcfaa5dc73345436757416cbe89977ef6b4509da7cdb235d8b0b67163c8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5076	notepad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 5076	3016	5bedafcfaa5dc73345436757416cbe89977ef6b4509da7cdb235d8b0b67163c8.exe	80
PID 3016 wrote to memory of 5076	3016	5bedafcfaa5dc73345436757416cbe89977ef6b4509da7cdb235d8b0b67163c8.exe	80
PID 3016 wrote to memory of 5076	3016	5bedafcfaa5dc73345436757416cbe89977ef6b4509da7cdb235d8b0b67163c8.exe	80

C:\Users\Admin\AppData\Local\Temp\5bedafcfaa5dc73345436757416cbe89977ef6b4509da7cdb235d8b0b67163c8.exe
"C:\Users\Admin\AppData\Local\Temp\5bedafcfaa5dc73345436757416cbe89977ef6b4509da7cdb235d8b0b67163c8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\hwid.ini
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\hwid.ini

Filesize
44B

MD5
8a693ff393560d2500e6e40c3aecade7

SHA1
b83fb141ff0887ecdcea862d73d51cfcd881d234

SHA256
6e32fdc476aa14f1d7ded17065ea1a9fb4531ff53dd20b9ebca00335b9698165

SHA512
d0ecbd8d3b0088a109478301a75a804ae011408fcc9440e4ff0e71b92ce2b4b704a64daecf3adfbaa746338ce3069044f8ed601be5eadf38f7e6982007dcda69

Download Submit