a3172e45bb1824fa625a04ff1d7e08617de13309ba9d31fb6b03ec9a921f345b

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2022 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe
Size

117KB
MD5

22fae9b2afe673318d4d8de9b2b7826c
SHA1

c9181742312a14f56df830d0bffe501e1772a75d
SHA256

3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0
SHA512

af58daf87e5ae240b8a927c8f87a5a0bf81f1b5463eec810e3633c93650f0d564494731638428bc3eeda86946c8e7af329fc07bfc3ec4edd31a37c3a3145f8f1
SSDEEP

3072:Mx6HSJqSSSSF4GFEbfYKtM2n3FSOyUijEQoSSSZKVIcgqBJi7nQXpetJaSuSWSCn:dHSJqSSSSF4Pfntd3FSPjnoSSSZKVIcz

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe

pid process

3988 3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe

pid	process
3988	3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe	upx
C:\Users\Admin\AppData\Local\Temp\3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe	upx
behavioral8/memory/3988-136-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2088 3988 WerFault.exe 3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe

pid	pid_target	process	target process
2088	3988	WerFault.exe	3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe

description	pid	process	target process
PID 4648 wrote to memory of 3988	4648	3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe	3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe
PID 4648 wrote to memory of 3988	4648	3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe	3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe
PID 4648 wrote to memory of 3988	4648	3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe	3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe

C:\Users\Admin\AppData\Local\Temp\3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe
"C:\Users\Admin\AppData\Local\Temp\3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4648

C:\Users\Admin\AppData\Local\Temp\3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe
C:\Users\Admin\AppData\Local\Temp\3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe
2⤵
- Executes dropped EXE
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 264
3⤵
- Program crash
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3988 -ip 3988
1⤵
PID:4788

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe
Filesize
105KB

MD5
3235c81e22fad625ce09ae351091f7cc

SHA1
1a670de8ab6014928459f0c1631db644f7d7526e

SHA256
85d274964f8e3cba910a4922bdbdc0ed3b064c0045db18c85d8d2a853d00e7a6

SHA512
95797149ba60dc13795798549d566f309796ac7daad849c5295516855f53617c92e29a119d93a5da87d50a16d6a34308b3b0b0d0b3974b899fe2f21ca83f041b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0mgr.exe
Filesize
105KB

MD5
3235c81e22fad625ce09ae351091f7cc

SHA1
1a670de8ab6014928459f0c1631db644f7d7526e

SHA256
85d274964f8e3cba910a4922bdbdc0ed3b064c0045db18c85d8d2a853d00e7a6

SHA512
95797149ba60dc13795798549d566f309796ac7daad849c5295516855f53617c92e29a119d93a5da87d50a16d6a34308b3b0b0d0b3974b899fe2f21ca83f041b

Download Submit
memory/3988-132-0x0000000000000000-mapping.dmp

Download
memory/3988-136-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4648-135-0x0000000000150000-0x0000000000171000-memory.dmp

Filesize
132KB

Download