ffaa5eea301ca6578ee0b3403513d77264246a77c18c8d529021045c15452940

Analysis

max time kernel
109s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

569bb28f26e0170d21d0f5788a4ee262.exe
Size

2.1MB
MD5

569bb28f26e0170d21d0f5788a4ee262
SHA1

04740c6f85e9952aace33b43f16567e5b26152a0
SHA256

077ff4fd1a42fa755bb31b877c8ff2aea27683b31c65261bfe0d15cff0738934
SHA512

58db7e0d56e278801a35e4f762b0bca294f915e7720c039beb6d779d122aa344763bf71bafd698d70f0b217e7bf829b74f94563f56389925cf2a42dd6098cbc2
SSDEEP

49152:x/FBVWix5TC0/5ljAhscAWlMym/HXR1supwJ4Cf:

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	569bb28f26e0170d21d0f5788a4ee262.exe

Executes dropped EXE 1 IoCs

pid	Process
804	xiioz1jh.d1b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	569bb28f26e0170d21d0f5788a4ee262.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5376	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 804	2452	569bb28f26e0170d21d0f5788a4ee262.exe	87
PID 2452 wrote to memory of 804	2452	569bb28f26e0170d21d0f5788a4ee262.exe	87
PID 2452 wrote to memory of 5376	2452	569bb28f26e0170d21d0f5788a4ee262.exe	88
PID 2452 wrote to memory of 5376	2452	569bb28f26e0170d21d0f5788a4ee262.exe	88

C:\Users\Admin\AppData\Local\Temp\569bb28f26e0170d21d0f5788a4ee262.exe
"C:\Users\Admin\AppData\Local\Temp\569bb28f26e0170d21d0f5788a4ee262.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\xiioz1jh.d1b.exe
  "C:\Users\Admin\AppData\Local\Temp\xiioz1jh.d1b.exe"
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\model_skeleton_types.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\model_skeleton_types.txt

Filesize
7KB

MD5
0e59d0d6063057622d07a474b50f5b9f

SHA1
c51cf74a8b9fcfcbd3ae3a76accefb6ae8881c1b

SHA256
bf69634df7d3770ea7dc70e535217b19227175b11f6553fd7c8af6e7bc9813bc

SHA512
4af3367cca3c1d9db927b791a39f39dbcbd4a5016d26b7eca8d018638e922d945eb6811258631047ad70a6f3e9b82bb049af100e34e5c30cd12f3154cbb9b657

Download Submit
C:\Users\Admin\AppData\Local\Temp\xiioz1jh.d1b.exe

Filesize
777KB

MD5
67c847973f3c013e3e5049f6a82ae1b5

SHA1
ddd92d14cc4c4e1e5a3afcb24087f997e63f561f

SHA256
0efeb9b6ed577e71905b9944d794da8ee14084c6cde61d5bb695c10448c75933

SHA512
eff87736136998b54fdd952b4e85fa800d13bad9ffa9863dd55595f3e7ca2c557cf0ba45ab47fb06f79ba6efd07294f8f1fab30cd81c5b9bcc5e02f25419c86e

Download Submit
memory/804-15-0x000001E150340000-0x000001E150406000-memory.dmp

Filesize
792KB

Download
memory/804-17-0x00007FFA45350000-0x00007FFA45E11000-memory.dmp

Filesize
10.8MB

Download
memory/804-20-0x00007FFA45350000-0x00007FFA45E11000-memory.dmp

Filesize
10.8MB

Download
memory/2452-0-0x00007FFA45353000-0x00007FFA45355000-memory.dmp

Filesize
8KB

Download
memory/2452-1-0x0000000000410000-0x000000000062E000-memory.dmp

Filesize
2.1MB

Download