70a975dec6d95eb2003a7313ac7c6fa370b4c1a3e6d63a537bbfde7230de41d2

Analysis

max time kernel
21s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2022 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70a975dec6d95eb2003a7313ac7c6fa370b4c1a3e6d63a537bbfde7230de41d2.exe
Size

2.1MB
MD5

81e0ac102628cb06da86561351640647
SHA1

472fdf1bcf98a133f7a26b125d957b70804eaa40
SHA256

70a975dec6d95eb2003a7313ac7c6fa370b4c1a3e6d63a537bbfde7230de41d2
SHA512

e6f68ac7299e1bce0de0cd81a407645976c552a84feb5fbb6b1c566a9fbaca81cf9ac8ac6d99b5f9935508e3968b5469bdd99cfbd196b336fcf4702195e00ef8
SSDEEP

49152:JUBfJXAEUlfcBiVaaOA1Pmiqp6uwXWtzAsPWblvyh9EkxUp:JUBfKE+EB1aZPmyucWtzAsPWblvUOkxA

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

70a975dec6d95eb2003a7313ac7c6fa370b4c1a3e6d63a537bbfde7230de41d2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	70a975dec6d95eb2003a7313ac7c6fa370b4c1a3e6d63a537bbfde7230de41d2.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

2668 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2668	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

70a975dec6d95eb2003a7313ac7c6fa370b4c1a3e6d63a537bbfde7230de41d2.exe

description	pid	process	target process
PID 2228 wrote to memory of 2668	2228	70a975dec6d95eb2003a7313ac7c6fa370b4c1a3e6d63a537bbfde7230de41d2.exe	regsvr32.exe
PID 2228 wrote to memory of 2668	2228	70a975dec6d95eb2003a7313ac7c6fa370b4c1a3e6d63a537bbfde7230de41d2.exe	regsvr32.exe
PID 2228 wrote to memory of 2668	2228	70a975dec6d95eb2003a7313ac7c6fa370b4c1a3e6d63a537bbfde7230de41d2.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\70a975dec6d95eb2003a7313ac7c6fa370b4c1a3e6d63a537bbfde7230de41d2.exe
"C:\Users\Admin\AppData\Local\Temp\70a975dec6d95eb2003a7313ac7c6fa370b4c1a3e6d63a537bbfde7230de41d2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s QJYJ8gU8.u /u
2⤵
- Loads dropped DLL
PID:2668

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QJYJ8gU8.u
Filesize
2.0MB

MD5
f848a704674f23fc8c8845e9302affea

SHA1
d687a0fd9f4fd341bad98084a1939a85d21a40af

SHA256
ca84005fb26c99080d110070ac5099b031b5812eace167eea198f1c10a07a3c9

SHA512
1b1a9fbba01064bbe68cadc9a8efd497c42fa212f137243fa024629f886af8b819ddf77b59ac81b92e35b2c13c4dd53373c9abc07eb1cef3568e55604da30ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\QjYJ8gU8.u
Filesize
2.0MB

MD5
f848a704674f23fc8c8845e9302affea

SHA1
d687a0fd9f4fd341bad98084a1939a85d21a40af

SHA256
ca84005fb26c99080d110070ac5099b031b5812eace167eea198f1c10a07a3c9

SHA512
1b1a9fbba01064bbe68cadc9a8efd497c42fa212f137243fa024629f886af8b819ddf77b59ac81b92e35b2c13c4dd53373c9abc07eb1cef3568e55604da30ecc

Download Submit
memory/2668-132-0x0000000000000000-mapping.dmp

Download
memory/2668-135-0x0000000002C00000-0x0000000002D64000-memory.dmp

Filesize
1.4MB

Download
memory/2668-136-0x0000000002EA0000-0x0000000002FC4000-memory.dmp

Filesize
1.1MB

Download
memory/2668-137-0x0000000002FE0000-0x000000000309D000-memory.dmp

Filesize
756KB

Download
memory/2668-138-0x00000000030B0000-0x0000000003158000-memory.dmp

Filesize
672KB

Download
memory/2668-141-0x0000000002EA0000-0x0000000002FC4000-memory.dmp

Filesize
1.1MB

Download