56eaeb544a5b324a1b498dc1839a346277ea0ba6840f6d5ceb898b823f14d2d5

Analysis

max time kernel
102s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

730efb97bdfa1760333c3ab9323de9a1.exe
Size

2.1MB
MD5

730efb97bdfa1760333c3ab9323de9a1
SHA1

c5ebb5fbf59dd9d79d6e573fd493f72434372612
SHA256

4f4cde6b4437ff31686c3496b2f80e0402bf87ccdcbe1caca68d38f5034fb89d
SHA512

ce6dd9c0ec5c0c970750e97ba07ac79e9b09edad4e7ec1f00c01d0790d6bba07465227fcc3bcff124e7d3e7c0df35f7d5611a0090732d090e0bf671565358c3f
SSDEEP

49152:q/FBVWix5TC0/5ljAhscAWlMym/HXR1supwJ4Cf:

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	730efb97bdfa1760333c3ab9323de9a1.exe

Executes dropped EXE 1 IoCs

pid	Process
8	4nhn4qz2.b0r.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings	730efb97bdfa1760333c3ab9323de9a1.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1996	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 8	2324	730efb97bdfa1760333c3ab9323de9a1.exe	87
PID 2324 wrote to memory of 8	2324	730efb97bdfa1760333c3ab9323de9a1.exe	87
PID 2324 wrote to memory of 1996	2324	730efb97bdfa1760333c3ab9323de9a1.exe	88
PID 2324 wrote to memory of 1996	2324	730efb97bdfa1760333c3ab9323de9a1.exe	88

C:\Users\Admin\AppData\Local\Temp\730efb97bdfa1760333c3ab9323de9a1.exe
"C:\Users\Admin\AppData\Local\Temp\730efb97bdfa1760333c3ab9323de9a1.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\4nhn4qz2.b0r.exe
  "C:\Users\Admin\AppData\Local\Temp\4nhn4qz2.b0r.exe"
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\default_channels_template.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4nhn4qz2.b0r.exe

Filesize
777KB

MD5
67c847973f3c013e3e5049f6a82ae1b5

SHA1
ddd92d14cc4c4e1e5a3afcb24087f997e63f561f

SHA256
0efeb9b6ed577e71905b9944d794da8ee14084c6cde61d5bb695c10448c75933

SHA512
eff87736136998b54fdd952b4e85fa800d13bad9ffa9863dd55595f3e7ca2c557cf0ba45ab47fb06f79ba6efd07294f8f1fab30cd81c5b9bcc5e02f25419c86e

Download Submit
C:\Users\Admin\AppData\Local\Temp\default_channels_template.txt

Filesize
450B

MD5
5ab46d587a194a7a7e0b871bab8e1df1

SHA1
6b55a2cd4846304b67df9e17f6e67a1de2568016

SHA256
0f2940f551c5677d72b2f9faf551ab99c5dbedcdbe61d08ca1ffe0cd92848a14

SHA512
af220d3cd53e015fae2af4e328456be3f4efbd2061145aa9502a91c3a68a5359686b60bf42feb4d96d83268051a213ccee5d6a362e942f66b93f9a07a4073ae0

Download Submit
memory/8-15-0x000001EBE0480000-0x000001EBE0546000-memory.dmp

Filesize
792KB

Download
memory/8-17-0x00007FF9947C0000-0x00007FF995281000-memory.dmp

Filesize
10.8MB

Download
memory/8-20-0x00007FF9947C0000-0x00007FF995281000-memory.dmp

Filesize
10.8MB

Download
memory/2324-0-0x00007FF9947C3000-0x00007FF9947C5000-memory.dmp

Filesize
8KB

Download
memory/2324-1-0x0000000000FD0000-0x00000000011E8000-memory.dmp

Filesize
2.1MB

Download