7f14f5b831d5c9b212fb43f420c5b685fb5be173564dfb4edff70e29e5a0d306

Analysis

max time kernel
141s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2022, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Variant.Bulz.342535.8726.exe
Size 4.3MB
Sample220818-kf1drsfaa6
SHA256 7f14f5b831d5c9b212fb43f420c5b685fb5be173564dfb4edff70e29e5a0d306
MD5 a267d58bf6913e3c289d452109f88f06
SHA1 9413185764215de2c35d250b61bba0978f41fbab
SHA512 ef1e0bef585633ca98a9ad1ef7c2674ba9e61a5ff7936cbcf549578f7e07d93c9dc6c0fb17e474efd14d0ed2953961503cb7fa1b21e9c68409fc7a930a3193bb
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	mspaint.exe
4560	mspaint.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1676	SecuriteInfo.com.Variant.Bulz.342535.8726.exe
1676	SecuriteInfo.com.Variant.Bulz.342535.8726.exe
1676	SecuriteInfo.com.Variant.Bulz.342535.8726.exe
4560	mspaint.exe
4560	mspaint.exe
4560	mspaint.exe
4560	mspaint.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 4912	1676	SecuriteInfo.com.Variant.Bulz.342535.8726.exe	83
PID 1676 wrote to memory of 4912	1676	SecuriteInfo.com.Variant.Bulz.342535.8726.exe	83
PID 1676 wrote to memory of 4912	1676	SecuriteInfo.com.Variant.Bulz.342535.8726.exe	83
PID 4912 wrote to memory of 4560	4912	cmd.exe	85
PID 4912 wrote to memory of 4560	4912	cmd.exe	85
PID 4912 wrote to memory of 4560	4912	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.342535.8726.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.342535.8726.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\877976.bmp
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\877976.bmp"
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads