576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
05/03/2022, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1.exe
Size

214KB
MD5

e609a4e0e0a91ebc8771fcc3f25c0990
SHA1

c552fbec8d6679017b5e9dedd4f03e29cb4c8718
SHA256

576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1
SHA512

0fab0c68eec67ce7e54b28651b0c85f6fd0401888e83e7b2346acc95a802d283185a77790cdb98f3850350a190cfe30b7e9d757fcfb95a8012adc34393eeffda

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2100	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run	576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe\" -start"	576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
640	2100	WerFault.exe	57

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2100	1404	576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1.exe	57
PID 1404 wrote to memory of 2100	1404	576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1.exe	57
PID 1404 wrote to memory of 2100	1404	576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1.exe	57

C:\Users\Admin\AppData\Local\Temp\576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1.exe
"C:\Users\Admin\AppData\Local\Temp\576b9b0e6da2715dc02068b053b4203b9bfda1eb0feca8bddcdfc0827c5db7d1.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" -start
  2⤵
  - Executes dropped EXE
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 664
    3⤵
    - Program crash
    PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2100 -ip 2100
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads