a3172e45bb1824fa625a04ff1d7e08617de13309ba9d31fb6b03ec9a921f345b

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2022 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe
Size

117KB
MD5

083b5b2003bc9b2c4cd423b086ad5265
SHA1

9fff262f74d9ecf446eabbb2e9136f1bd6c521d4
SHA256

6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc
SHA512

23999df69b89b2ead229daddbb4d76637c42e7db6b004401f10631fcfe437d40e70af18a92b7d8105610568f6311f9899398aec6296a74a3a932f8d1fdacdcc5
SSDEEP

1536:zPFAoF9649rqWOQMg7AQxfrtJlIactudzEIe7nii2nf4ljawM/0ZAmhQuz:Dx64CrsnxWhudIzioaz/YQuz

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe

pid process

4608 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe

pid	process
4608	6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe	upx
C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe	upx
behavioral12/memory/4608-136-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4632 4608 WerFault.exe 6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe

pid	pid_target	process	target process
4632	4608	WerFault.exe	6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe

description	pid	process	target process
PID 4208 wrote to memory of 4608	4208	6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe	6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe
PID 4208 wrote to memory of 4608	4208	6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe	6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe
PID 4208 wrote to memory of 4608	4208	6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe	6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe

C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe
"C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4208

C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe
C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe
2⤵
- Executes dropped EXE
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 264
3⤵
- Program crash
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4608 -ip 4608
1⤵
PID:2432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe
Filesize
105KB

MD5
3235c81e22fad625ce09ae351091f7cc

SHA1
1a670de8ab6014928459f0c1631db644f7d7526e

SHA256
85d274964f8e3cba910a4922bdbdc0ed3b064c0045db18c85d8d2a853d00e7a6

SHA512
95797149ba60dc13795798549d566f309796ac7daad849c5295516855f53617c92e29a119d93a5da87d50a16d6a34308b3b0b0d0b3974b899fe2f21ca83f041b

Download Submit
C:\Users\Admin\AppData\Local\Temp\6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dcmgr.exe
Filesize
105KB

MD5
3235c81e22fad625ce09ae351091f7cc

SHA1
1a670de8ab6014928459f0c1631db644f7d7526e

SHA256
85d274964f8e3cba910a4922bdbdc0ed3b064c0045db18c85d8d2a853d00e7a6

SHA512
95797149ba60dc13795798549d566f309796ac7daad849c5295516855f53617c92e29a119d93a5da87d50a16d6a34308b3b0b0d0b3974b899fe2f21ca83f041b

Download Submit
memory/4208-132-0x0000000000860000-0x0000000000881000-memory.dmp

Filesize
132KB

Download
memory/4208-137-0x0000000000860000-0x0000000000881000-memory.dmp

Filesize
132KB

Download
memory/4608-133-0x0000000000000000-mapping.dmp

Download
memory/4608-136-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download