6aed6fd40b97a00e866b0aa2b487850aa08bd1fbcdccd87bfbdbf4c65a9021f6

Analysis

max time kernel
99s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2022, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1983a12bab165e31183305cbf4b280f0.exe
Size 80KB
Sample220817-2tx91aggh9
SHA256 6aed6fd40b97a00e866b0aa2b487850aa08bd1fbcdccd87bfbdbf4c65a9021f6
MD5 1983a12bab165e31183305cbf4b280f0
SHA1 79ea668480c2c9429c79d786c53989c8a7dcfd8e
SHA512 858cec5b46ddd09e3ce7643145c65082246a20ea6964f88faee348078c09c6c8bc6ea5317d5c21cbd9a4420a2a105de6c62f01d535541f95363acbba916142f1
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	4428	rundll32.exe	83

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	1983a12bab165e31183305cbf4b280f0.exe

Loads dropped DLL 1 IoCs

pid	Process
4776	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4420	4776	WerFault.exe	85

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 3828	788	1983a12bab165e31183305cbf4b280f0.exe	81
PID 788 wrote to memory of 3828	788	1983a12bab165e31183305cbf4b280f0.exe	81
PID 788 wrote to memory of 3828	788	1983a12bab165e31183305cbf4b280f0.exe	81
PID 3388 wrote to memory of 4776	3388	rundll32.exe	85
PID 3388 wrote to memory of 4776	3388	rundll32.exe	85
PID 3388 wrote to memory of 4776	3388	rundll32.exe	85

C:\Users\Admin\AppData\Local\Temp\1983a12bab165e31183305cbf4b280f0.exe
"C:\Users\Admin\AppData\Local\Temp\1983a12bab165e31183305cbf4b280f0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:788
- C:\Users\Admin\AppData\Local\Temp\1983a12bab165e31183305cbf4b280f0.exe
  "C:\Users\Admin\AppData\Local\Temp\1983a12bab165e31183305cbf4b280f0.exe" -h
  2⤵
  PID:3828

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
  2⤵
  - Loads dropped DLL
  PID:4776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 600
    3⤵
    - Program crash
    PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4776 -ip 4776
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

db.dat

Path C:\Users\Admin\AppData\Local\Temp\db.dat
Size 557KB
SHA256 b7308cd90f5741d707b339fea43015763ad5aebb5bcd5a08b917a1690df81f38
MD5 2b5c83d43efb82b4071edf849057bf25
SHA1 643e81a40f6d7d376d399441eaa566a3320776d6
SHA512 ebf2d1c52aa0faff71b4219792dafc142e353abc84e01e971d292c2f166964e8e521efaeb29a169b04bd75d71465596f3c8a1ed27bb89b507c252b46f21a283a
SSDEEP 12288:GRpkOAz5McByQtalO8GE78Ly/rD46NhGU+h8kimGuW:0qyNlg6D46NlyH0t
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 60KB
SHA256 0ccbfa243400e47b4025c9ade105bdc311058538303e4606d7efaa819fe23c10
MD5 6593d63ef0aeaeaaa73b768cde6268d1
SHA1 1c30e4d776d4031e0a40a83590a15369157b73ba
SHA512 18cce6ed9e4311c7b3263ca10670e044e6d3c8765bbddddc6e852a08fecb78b600c15956a0b1c8f595157bd34861e8e55a972909b8ec0e34f061701404b82125
SSDEEP 768:xD1bsLYHRFgN6g28zY+MVGAByZwtVtHhxVoUvZHz870aIFuaw:F1NDmdMVGHAtrrhHz870Bg
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 60KB
SHA256 0ccbfa243400e47b4025c9ade105bdc311058538303e4606d7efaa819fe23c10
MD5 6593d63ef0aeaeaaa73b768cde6268d1
SHA1 1c30e4d776d4031e0a40a83590a15369157b73ba
SHA512 18cce6ed9e4311c7b3263ca10670e044e6d3c8765bbddddc6e852a08fecb78b600c15956a0b1c8f595157bd34861e8e55a972909b8ec0e34f061701404b82125
SSDEEP 768:xD1bsLYHRFgN6g28zY+MVGAByZwtVtHhxVoUvZHz870aIFuaw:F1NDmdMVGHAtrrhHz870Bg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads