63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6

General

Target
63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6.exe
Size 85KB
Sample220129-wg5knafef5
SHA256 63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6
MD5 c2a0344a2bbb29d9b56d378386afcbed
SHA1 015425010bd4cf9d511f7fcd0fc17fc17c23eec1
SHA512 b05347ae6646bc1dda93d1c10a526287937313ed06d67db70763c2ca84cf2d1bbe375a2032c50aeceb463aea51271608809f49f30acc3b2b23b2c598398107e3
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 4 IoCs

Loads dropped DLL 1 IoCs

pid	Process
1920	rundll32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\api-ms-win-downlevel-profile-l1-1-0.dll	63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A}	63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A}\ = "Microsoft security"	63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A}\InProcServer32	63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A}\InProcServer32\ = "C:\\Windows\\SysWow64\\api-ms-win-downlevel-profile-l1-1-0.dll"	63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	rundll32.exe
1920	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 1920	2700	63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6.exe	68
PID 2700 wrote to memory of 1920	2700	63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6.exe	68
PID 2700 wrote to memory of 1920	2700	63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6.exe	68