9ad06b0e000800a33d381949658dbd0bfd7c7f1025aa5c81621b55f2f69a7a3f

Analysis

max time kernel
101s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26-05-2022 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data64_6.exe
Size

1.9MB
MD5

87953bdf18ba88061cf28ad17116b56f
SHA1

bc04b30d0e7ca0fc34b1d507ab4b991e0cc5dbc6
SHA256

9ad06b0e000800a33d381949658dbd0bfd7c7f1025aa5c81621b55f2f69a7a3f
SHA512

19d8520c62da97a0a793c1f9eb17ae5865ea3d6d9e4734ac5e4069c864f52fccf06d5961c136095c73e7ee6c3ce1e9ae0038f32e8941f5aa2599327111b386c3

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

data64_6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	data64_6.exe

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exe

pid process

4188 regsvr32.exe
4188 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4188	regsvr32.exe
4188	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

data64_6.exe

description	pid	process	target process
PID 4352 wrote to memory of 4188	4352	data64_6.exe	regsvr32.exe
PID 4352 wrote to memory of 4188	4352	data64_6.exe	regsvr32.exe
PID 4352 wrote to memory of 4188	4352	data64_6.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\data64_6.exe
"C:\Users\Admin\AppData\Local\Temp\data64_6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4352

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /U /S V8NgH.K
2⤵
- Loads dropped DLL
PID:4188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\V8NgH.K
Filesize
633.0MB

MD5
ce51a23041790ab6f85c2bface536a25

SHA1
985cafcbc7fd055c42a662fade04ef13b5fb3451

SHA256
f3fe576f3b7b492b5888e121341b53cb6632d020f5f56295d9419a014e1c559a

SHA512
49d8ac38288c5acf008214a3487e2bb7965bbf77a4fa714d4ff1096e1c0d004d32fc6a3440a9c51c852681c6209f6a0394c98a020cf290c5edba24c27e99447c

Download Submit
C:\Users\Admin\AppData\Local\Temp\v8NgH.K
Filesize
682.8MB

MD5
dec75150ae1a88326cfbba1ad4d90345

SHA1
65b35717ab19045a80017968c353880aa01fe08f

SHA256
346f5d0021dbd8ffeb55fb83e6841c6442c8720c615cba5b9b2e469d1306d6b7

SHA512
3d319e1438b1af5900df98dc05e443d0bfb8e0a008d0e145a430fb0c8dfd0fe9864da94f9c4ed3194633daf7ca6fb1aef71ffda8b8fc64e962050808a7d35ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\v8NgH.K
Filesize
682.8MB

MD5
dec75150ae1a88326cfbba1ad4d90345

SHA1
65b35717ab19045a80017968c353880aa01fe08f

SHA256
346f5d0021dbd8ffeb55fb83e6841c6442c8720c615cba5b9b2e469d1306d6b7

SHA512
3d319e1438b1af5900df98dc05e443d0bfb8e0a008d0e145a430fb0c8dfd0fe9864da94f9c4ed3194633daf7ca6fb1aef71ffda8b8fc64e962050808a7d35ebd

Download Submit
memory/4188-130-0x0000000000000000-mapping.dmp

Download
memory/4188-134-0x0000000002390000-0x0000000003390000-memory.dmp

Filesize
16.0MB

Download
memory/4188-135-0x000000002D290000-0x000000002D36F000-memory.dmp

Filesize
892KB

Download
memory/4188-136-0x000000002D430000-0x000000002D4EB000-memory.dmp

Filesize
748KB

Download
memory/4188-137-0x000000002D4F0000-0x000000002D5A4000-memory.dmp

Filesize
720KB

Download
memory/4188-138-0x000000002D5B0000-0x000000002D650000-memory.dmp

Filesize
640KB

Download