189d5c23910cd58759aafae7139b258fc85d6fd588c04e56479d0c05a4dcdffd

Analysis

max time kernel
76s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2022, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc063812fa41b939bb950a9ed47cc768.exe
Size 76KB
Sample220930-ewc1hsdddk
SHA256 189d5c23910cd58759aafae7139b258fc85d6fd588c04e56479d0c05a4dcdffd
MD5 fc063812fa41b939bb950a9ed47cc768
SHA1 10821d989d81b5ed542b95ffd35d33c5f59159b7
SHA512 d7ada6ea9289b893170bd7160255a202eeb3004d259bfc22905f12f976e3d79d1bee9d67f450257c5df294fe603b6b83b5b74e18d6d5a1dfbd495a01ae40ee07
SSDEEP 768:P3rtHL1uKHMbw0KyJKNhkKqEAq/YDC+ggWo+rWEGmlH6W/mqsBdnmz5BZEyY7t89:fr1RupbQauqK/jhrP/mgnat89
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	2400	rundll32.exe	23

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	fc063812fa41b939bb950a9ed47cc768.exe

Loads dropped DLL 1 IoCs

pid	Process
4628	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4192	4628	WerFault.exe	92

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2776	624	fc063812fa41b939bb950a9ed47cc768.exe	86
PID 624 wrote to memory of 2776	624	fc063812fa41b939bb950a9ed47cc768.exe	86
PID 624 wrote to memory of 2776	624	fc063812fa41b939bb950a9ed47cc768.exe	86
PID 3776 wrote to memory of 4628	3776	rundll32.exe	92
PID 3776 wrote to memory of 4628	3776	rundll32.exe	92
PID 3776 wrote to memory of 4628	3776	rundll32.exe	92

C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe
"C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe
  "C:\Users\Admin\AppData\Local\Temp\fc063812fa41b939bb950a9ed47cc768.exe" -h
  2⤵
  PID:2776

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:4628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 608
    3⤵
    - Program crash
    PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4628 -ip 4628
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

db.dat

Path C:\Users\Admin\AppData\Local\Temp\db.dat
Size 557KB
SHA256 556fd54e5595d222cfa2bd353afa66d8d4d1fbb3003afed604672fceae991860
MD5 76c3dbb1e9fea62090cdf53dadcbe28e
SHA1 d44b32d04adc810c6df258be85dc6b62bd48a307
SHA512 de4ea57497cf26237430880742f59e8d2a0ac7e7a0b09ed7be590f36fbd08c9ced0ffe46eb69ec2215a9cff55720f24fffcae752cd282250b4da6b75a30b3a1b
SSDEEP 12288:FV1e0UgkVT6ZT+3JCnoxgLMoCXwbePLJrH8fwpj:FV1edgkV8T0Cnoxt4ePLJTMwpj
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 9e02e104e1ab52a1c33d650c34d05a641c53e8edd5471c7ee4f68f29c79d62c1
MD5 e2082e7d7eeb4a3d599472a33cbaca24
SHA1 add8cf241e8fa6ec1e18317a7f3972e900dd9ab7
SHA512 ae880716e0a2db43797a55294e101ad92323a0f08443c0337c4abe4d049375821b04b08744889c992b2a01396e89702585e9a3688e6c795e208e3dd594a99e07
SSDEEP 768:ZSD7R43xFiSK6u2oYf45rVGAYvZZ0UtVtnR:8DaTxGrVGxvhtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 9e02e104e1ab52a1c33d650c34d05a641c53e8edd5471c7ee4f68f29c79d62c1
MD5 e2082e7d7eeb4a3d599472a33cbaca24
SHA1 add8cf241e8fa6ec1e18317a7f3972e900dd9ab7
SHA512 ae880716e0a2db43797a55294e101ad92323a0f08443c0337c4abe4d049375821b04b08744889c992b2a01396e89702585e9a3688e6c795e208e3dd594a99e07
SSDEEP 768:ZSD7R43xFiSK6u2oYf45rVGAYvZZ0UtVtnR:8DaTxGrVGxvhtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads