9cbde46a7df0a6e7ba3ec5099c4b4fc087d027e3016f8486ad17efe5261af8e2

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2022, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xRPq9dE9O8Nw.exe
Size 465KB
Sample220810-yldnvaeccr
SHA256 9cbde46a7df0a6e7ba3ec5099c4b4fc087d027e3016f8486ad17efe5261af8e2
MD5 a0ac1b5c1020bf5f6c787eab8b418a30
SHA1 b7609339e58a5e329e26630fb7ebfc67ff7f7494
SHA512 aa9617a29b3e02407a10f280cfdf145f4eb04724edd53f6933038818e5e476dd11af25b9c18f813d080224e164bfe686e8ff0c8cdbc0eb7b45d576ec1b2539d1
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	xRPq9dE9O8Nw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Local Settings	xRPq9dE9O8Nw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4788	xRPq9dE9O8Nw.exe
4788	xRPq9dE9O8Nw.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 5112	4788	xRPq9dE9O8Nw.exe	91
PID 4788 wrote to memory of 5112	4788	xRPq9dE9O8Nw.exe	91
PID 4788 wrote to memory of 5112	4788	xRPq9dE9O8Nw.exe	91

C:\Users\Admin\AppData\Local\Temp\xRPq9dE9O8Nw.exe
"C:\Users\Admin\AppData\Local\Temp\xRPq9dE9O8Nw.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wekejkgovygudsoqgrvdlczrberu.vbs"
  2⤵
  PID:5112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wekejkgovygudsoqgrvdlczrberu.vbs

Path C:\Users\Admin\AppData\Local\Temp\wekejkgovygudsoqgrvdlczrberu.vbs
Size 520B
SHA256 708e9a3363d4e48c04af5b0369039e3487b465897dac195144664da0352b0da6
MD5 c932b8344542699ac54a09e5f15d9271
SHA1 6ea71f7f64ec891667dfc888e34a7bc8973e3dbd
SHA512 d1298033b0eb42b883da6bca577952e5da92c4fbceabebed59cb7a176e40289d4bd9f7c0888c847553bf49c3d182968b786a81705a1d1293930d67029b58f03f
MD5 SHA1 SHA512

Submit Download