37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/05/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe
Size 59KB
Sample260529-ar2e4aey2k
SHA256 37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d
MD5 74ee035b20a8cf19ef36b01071e5147b
SHA1 e132f6564aa631608fe7436e035a0a177e8bdf8a
SHA512 b188f74d040cf60289220c942beb08b9d6bf9a0f87d33d3e29c5ee771a38ec605158485566a0d207fcd49ec89e3287e03950236fba7bc6fbb53d45c62f21dfd5
SSDEEP 1536:Fai2SnTCAB8hs2Ds8lFJH/N1RekrCJLPmmVzd:FT1nTC08hs2AaFJfTRdrCxB
TLSH
T1A8535B4BE36400F4E1B3863089E79A16BA33F846C735524F46A495AA1F733D1EE38779
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
752	timeout.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	4732	vssvc.exe
Token: SeRestorePrivilege	4732	vssvc.exe
Token: SeAuditPrivilege	4732	vssvc.exe
Token: SeDebugPrivilege	312	37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 4732	312	37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe	85
PID 312 wrote to memory of 4812	312	37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe	89
PID 4812 wrote to memory of 752	4812	cmd.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe
"C:\Users\Admin\AppData\Local\Temp\37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\37837c81551b43dee4b1176840bf67617601a80ce1e2e971ab3f97bea7720c1d.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4732-0-0x0000025E614A0000-0x0000025E614A1000-memory.dmp

Download