695be1aadcdb760c8d7ac73563e4e5d41edc809ca60d9c4b57435a6971325469

General

Target
5d43ee8b1589f21a8e883fe3670bf226.exe
Size 1.7MB
Sample220527-w8cc7agcf3
SHA256 695be1aadcdb760c8d7ac73563e4e5d41edc809ca60d9c4b57435a6971325469
MD5 5d43ee8b1589f21a8e883fe3670bf226
SHA1 a3cb9316c93e79fff91b3d16ee886bdd9a54ee85
SHA512 6d168778dcaa66d6e81d488d99c2c0be43779c95dec7052a3cac6286a49102fcd2bd5c6a4dd4d6c789985e58278036465fe64409b552a0c9cae73a889c1022c8
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	5d43ee8b1589f21a8e883fe3670bf226.exe

Loads dropped DLL 2 IoCs

pid	Process
1480	rundll32.exe
1480	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	5d43ee8b1589f21a8e883fe3670bf226.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 4188	2576	5d43ee8b1589f21a8e883fe3670bf226.exe	79
PID 2576 wrote to memory of 4188	2576	5d43ee8b1589f21a8e883fe3670bf226.exe	79
PID 2576 wrote to memory of 4188	2576	5d43ee8b1589f21a8e883fe3670bf226.exe	79
PID 4188 wrote to memory of 1480	4188	control.exe	81
PID 4188 wrote to memory of 1480	4188	control.exe	81
PID 4188 wrote to memory of 1480	4188	control.exe	81

C:\Users\Admin\AppData\Local\Temp\5d43ee8b1589f21a8e883fe3670bf226.exe
"C:\Users\Admin\AppData\Local\Temp\5d43ee8b1589f21a8e883fe3670bf226.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\HDEfpdY.cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\HDEfpdY.cpl",
    3⤵
    - Loads dropped DLL
    PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HDEfpdY.cpl

Path C:\Users\Admin\AppData\Local\Temp\HDEfpdY.cpl
Size 125.6MB
SHA256 2aed1e48a62021625644150c3ec500b674ce4cacfb7435fac05a92d0ef0d91ed
MD5 a543e425ee0d49da0556c69fdf06ec21
SHA1 47f936f5484b3fd8440884ce7e22c24f891cb04f
SHA512 b92064c0699c8b722742f5294cfa6478f43d501d7d6e6e64901bf1c6ca29c43e5a9d70f0fdf5791a3a66f5f13810ce0e0659135ebe8ca66eaa6496e04d3d20bd
SSDEEP 49152:HyuTHxsvrNPZkJzyuKquNhmRVjlvkWKuHwo6fg:HyutsvrNhDuKcjlvFff6fg
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDefpdY.cpl

Path C:\Users\Admin\AppData\Local\Temp\HDefpdY.cpl
Size 126.8MB
SHA256 4f846a5800c4e9619800b1a643a5858dad3d48eff320da90b5c118e3134369c1
MD5 5a1c7113fa3e8617c4e8799b00ba4ffa
SHA1 51a6ea94875cc95aed6805a9cf45721cf4907cd0
SHA512 e18f7049cac159db25175f0f6831c4762c34096cfff4d6fb7e6f38503f52e3cefc9e95d521b906ee73de1210b2fdaaff60ece79276fcedc11162a526cf675a2e
SSDEEP 49152:HyuTHxsvrNPZkJzyuKquNhmRVjlvkWKuHwo6fg:HyutsvrNhDuKcjlvFff6fg
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDefpdY.cpl

Path C:\Users\Admin\AppData\Local\Temp\HDefpdY.cpl
Size 125.4MB
SHA256 ece2b51355dff7768caa6f1447ee03ba13abda1076bd816a53a040c10a849674
MD5 dc8e9f7e211859376baa7780fa17ab6c
SHA1 b8234429afc6965277e070e6ccd5b1d8233faf99
SHA512 555da4b27e903f1824702f219d1528e2ab5cab895ca82178a9bdadf5595bc6699f8a8c9ca800436c2ec0fc22dee67f328b2450b59a5d0c63008af1a933ea2ec1
SSDEEP 49152:HyuTHxsvrNPZkJzyuKquNhmRVjlvkWKuHwo6fg:HyutsvrNhDuKcjlvFff6fg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1480-135-0x0000000002C10000-0x0000000003C10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads