938c6ed84dd404ed8129ef773cc695ddecfb29203e34189760324caa569dfc97

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11/05/2022, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fae07b21b2ce5aa949208dd0540b768.exe
Size 2.0MB
Sample220511-jbs88aafdn
SHA256 938c6ed84dd404ed8129ef773cc695ddecfb29203e34189760324caa569dfc97
MD5 4fae07b21b2ce5aa949208dd0540b768
SHA1 98d1ceaf325f590999ce53677bf8bd47b2dbb0da
SHA512 08b6b1f71b1b3078aa0c4df2428d6329ef2660575b09941c4936535a93ac482167bd82048c5da7254fe9c1383f2c35b3a3312f2ec0aa9679fd1ee4c3165638df
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	4fae07b21b2ce5aa949208dd0540b768.exe

Loads dropped DLL 2 IoCs

pid	Process
4072	rundll32.exe
4072	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	4fae07b21b2ce5aa949208dd0540b768.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3592	2084	4fae07b21b2ce5aa949208dd0540b768.exe	86
PID 2084 wrote to memory of 3592	2084	4fae07b21b2ce5aa949208dd0540b768.exe	86
PID 2084 wrote to memory of 3592	2084	4fae07b21b2ce5aa949208dd0540b768.exe	86
PID 3592 wrote to memory of 4072	3592	control.exe	88
PID 3592 wrote to memory of 4072	3592	control.exe	88
PID 3592 wrote to memory of 4072	3592	control.exe	88
PID 4072 wrote to memory of 4084	4072	rundll32.exe	98
PID 4072 wrote to memory of 4084	4072	rundll32.exe	98

C:\Users\Admin\AppData\Local\Temp\4fae07b21b2ce5aa949208dd0540b768.exe
"C:\Users\Admin\AppData\Local\Temp\4fae07b21b2ce5aa949208dd0540b768.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\~pHDfR3I.CPL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\~pHDfR3I.CPL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\~pHDfR3I.CPL",
      4⤵
      PID:4084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~pHDfR3I.CPL

Path C:\Users\Admin\AppData\Local\Temp\~pHDfR3I.CPL
Size 578.8MB
SHA256 8e75593054fed0a4b6b0b15704c6d299cbdb18a94116375d63f1797512a52af7
MD5 272c832241c75271930359e600edbbff
SHA1 eaa155077c9a849331be20d8325059bde58db065
SHA512 cfea4ef256a4add9cb158ada13b527385743f90b665fafb7fa0fe838fc1079f00c03d93b8f128832b17f0bfc19c31fd1f3c651fdb3d51ca03ce686bfc29a9974
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:MkzHRxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

~pHDfR3I.cpl

Path C:\Users\Admin\AppData\Local\Temp\~pHDfR3I.cpl
Size 589.5MB
SHA256 e607644d1886ea64162ec5ba2cd6bbbc55e6dc3b27ce89c03e0e0960bb7351c9
MD5 36c59f001d63bb05ad40bc23ebecfce9
SHA1 0635b598f3ded7934acb9849633067e28d2ab9cc
SHA512 a01edeada21d2dce3fd62145871877ce3dc09ced31dfb5a7f3df63d0bf40d1e49b8b65f78d034b2c680dbdfd478276b4fbb15ae2298b9ecd87233fa6fd598a7d
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYPW:MkzHRxbMAWTEnhDTQFPW
MD5 SHA1 SHA512 SSDEEP

Submit Download

~pHDfR3I.cpl

Path C:\Users\Admin\AppData\Local\Temp\~pHDfR3I.cpl
Size 578.2MB
SHA256 0be36150e74294fa9e23417bff591bfcf1851e04a54b0833df3062033cfb7bf8
MD5 0b1c65f8fca85cd0a68f4957f71c21f2
SHA1 f1bcd49fffe8e41f0979d34ac3ae3456f352e5a5
SHA512 ca242ed4b92eca123f176f607997a833f9e432313ffc8515fa19788d5380ed985b869e81a60d94539e28693a1396803a501dd396e8d904739b16456d5f9f03f9
SSDEEP 24576:T4j7SgeblcKanhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:MkzHRxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4072-135-0x0000000002A40000-0x0000000003A40000-memory.dmp

Download

memory/4072-136-0x000000002D650000-0x000000002D70E000-memory.dmp

Download

memory/4072-137-0x000000002D7D0000-0x000000002D88A000-memory.dmp

Download

memory/4072-138-0x000000002D890000-0x000000002D944000-memory.dmp

Download

memory/4072-139-0x000000002D950000-0x000000002D9F0000-memory.dmp

Download

memory/4072-140-0x000000002D950000-0x000000002D9F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads