a3172e45bb1824fa625a04ff1d7e08617de13309ba9d31fb6b03ec9a921f345b

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2022 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe
Size

114KB
MD5

319251085e4357962fc78a832bb28ee5
SHA1

69d1f802f6251506fcb2cdd04bc016ba9e79b135
SHA256

1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c
SHA512

8761fd841317d080a24ab6ed4e46d8ef0222b927186b609d51a174ae3d86384d95327a5bf0c9a76630fb617c1bc81c2c6d1c9bbc3eb4029d45c0184c6dcc4945
SSDEEP

3072:2Ql0wN4WLO1Io0zfx/GzXlPE7lQFsUMt1HirQd:9Z4WLOGfs5E7lQFVMt1Cr4

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe

pid process

4292 1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe

pid	process
4292	1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe	upx
C:\Users\Admin\AppData\Local\Temp\1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe	upx
behavioral2/memory/4292-136-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5044 4292 WerFault.exe 1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe

pid	pid_target	process	target process
5044	4292	WerFault.exe	1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe

description	pid	process	target process
PID 1800 wrote to memory of 4292	1800	1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe	1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe
PID 1800 wrote to memory of 4292	1800	1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe	1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe
PID 1800 wrote to memory of 4292	1800	1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe	1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe

C:\Users\Admin\AppData\Local\Temp\1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe
"C:\Users\Admin\AppData\Local\Temp\1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1800

C:\Users\Admin\AppData\Local\Temp\1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe
C:\Users\Admin\AppData\Local\Temp\1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe
2⤵
- Executes dropped EXE
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 272
3⤵
- Program crash
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4292 -ip 4292
1⤵
PID:924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe
Filesize
105KB

MD5
3235c81e22fad625ce09ae351091f7cc

SHA1
1a670de8ab6014928459f0c1631db644f7d7526e

SHA256
85d274964f8e3cba910a4922bdbdc0ed3b064c0045db18c85d8d2a853d00e7a6

SHA512
95797149ba60dc13795798549d566f309796ac7daad849c5295516855f53617c92e29a119d93a5da87d50a16d6a34308b3b0b0d0b3974b899fe2f21ca83f041b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288cmgr.exe
Filesize
105KB

MD5
3235c81e22fad625ce09ae351091f7cc

SHA1
1a670de8ab6014928459f0c1631db644f7d7526e

SHA256
85d274964f8e3cba910a4922bdbdc0ed3b064c0045db18c85d8d2a853d00e7a6

SHA512
95797149ba60dc13795798549d566f309796ac7daad849c5295516855f53617c92e29a119d93a5da87d50a16d6a34308b3b0b0d0b3974b899fe2f21ca83f041b

Download Submit
memory/1800-135-0x0000000000210000-0x0000000000231000-memory.dmp

Filesize
132KB

Download
memory/4292-132-0x0000000000000000-mapping.dmp

Download
memory/4292-136-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download