4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

08/04/2025, 14:11

250408-rhjmcsvp15 10

22/03/2025, 06:18

250322-g2ywaay1fy 10

Analysis

max time kernel
102s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f97418dbfcdd3f6d26c6cad46d16ec06.exe
Size

2.1MB
MD5

f97418dbfcdd3f6d26c6cad46d16ec06
SHA1

6a27ff3bd4f16221eb56f00bd0618c33ebd77973
SHA256

a1d077893568830b15dbf3996ed1a5c53a32314f128663539032289c686e61db
SHA512

959257a8be5831e26baab82a6df907ad9c796f181d74f02baf3c05eef102122606610e08a815bba73da9a24251555136b636c943a59f375f26609827bdda210e
SSDEEP

49152:q/FBVWix5TC0/5ljAhscAWlMym/HXR1supwJ4Cf:

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	f97418dbfcdd3f6d26c6cad46d16ec06.exe

Executes dropped EXE 1 IoCs

pid	Process
4532	zufj5nrj.zdl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Local Settings	f97418dbfcdd3f6d26c6cad46d16ec06.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4572	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5584 wrote to memory of 4532	5584	f97418dbfcdd3f6d26c6cad46d16ec06.exe	87
PID 5584 wrote to memory of 4532	5584	f97418dbfcdd3f6d26c6cad46d16ec06.exe	87
PID 5584 wrote to memory of 4572	5584	f97418dbfcdd3f6d26c6cad46d16ec06.exe	88
PID 5584 wrote to memory of 4572	5584	f97418dbfcdd3f6d26c6cad46d16ec06.exe	88

C:\Users\Admin\AppData\Local\Temp\f97418dbfcdd3f6d26c6cad46d16ec06.exe
"C:\Users\Admin\AppData\Local\Temp\f97418dbfcdd3f6d26c6cad46d16ec06.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Users\Admin\AppData\Local\Temp\zufj5nrj.zdl.exe
  "C:\Users\Admin\AppData\Local\Temp\zufj5nrj.zdl.exe"
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\sdk_config.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sdk_config.txt

Filesize
374B

MD5
406e8da4667432a08b16da320bce3c8b

SHA1
ef805b44438f9da3f9a5f3c61a7a7c4d620cc912

SHA256
4f7cc6b92648bf06988b8e1ee4e00a728d31b7caa090fde4855ac3bcd7e2ee66

SHA512
94a54d3e969599ec0c320c120eee1a2e56e6cf264e391459d9924d76288c56a72aa08f25ddf694eb6901262060f81c2bb891aa05441271fedc5087e469a8daed

Download Submit
C:\Users\Admin\AppData\Local\Temp\zufj5nrj.zdl.exe

Filesize
777KB

MD5
67c847973f3c013e3e5049f6a82ae1b5

SHA1
ddd92d14cc4c4e1e5a3afcb24087f997e63f561f

SHA256
0efeb9b6ed577e71905b9944d794da8ee14084c6cde61d5bb695c10448c75933

SHA512
eff87736136998b54fdd952b4e85fa800d13bad9ffa9863dd55595f3e7ca2c557cf0ba45ab47fb06f79ba6efd07294f8f1fab30cd81c5b9bcc5e02f25419c86e

Download Submit
memory/4532-14-0x0000025C2D4F0000-0x0000025C2D5B6000-memory.dmp

Filesize
792KB

Download
memory/4532-16-0x00007FFC49750000-0x00007FFC4A211000-memory.dmp

Filesize
10.8MB

Download
memory/4532-20-0x00007FFC49750000-0x00007FFC4A211000-memory.dmp

Filesize
10.8MB

Download
memory/5584-0-0x00007FFC49753000-0x00007FFC49755000-memory.dmp

Filesize
8KB

Download
memory/5584-1-0x0000000000550000-0x0000000000768000-memory.dmp

Filesize
2.1MB

Download