Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
11/05/2022, 06:36
General
- Target 6ccf4bb38c29d6bf80a982151a76c2b0.exe
- Size 2.0MB
- Sample220511-hcw6tsfhb7
- SHA256 ef9b5cd510ae1b3c49c5801dd5e8d46f5ebed70cf663185246e95ae764093e5a
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ccf4bb38c29d6bf80a982151a76c2b0.exe"C:\Users\Admin\AppData\Local\Temp\6ccf4bb38c29d6bf80a982151a76c2b0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -U .\wWSG8_I_.p -s2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
wWSG8_I_.p
wWSG8_I_.p
wWSG8_I_.p
memory/4412-134-0x0000000002CD0000-0x0000000003CD0000-memory.dmp
memory/4412-135-0x000000002DB90000-0x000000002DC4E000-memory.dmp
memory/4412-136-0x000000002DD10000-0x000000002DDCA000-memory.dmp
memory/4412-137-0x000000002DDD0000-0x000000002DE84000-memory.dmp
memory/4412-138-0x000000002DEA0000-0x000000002DF40000-memory.dmp
memory/4412-139-0x000000002DEA0000-0x000000002DF40000-memory.dmp