d9b3743b289486e90dbd66f614904fb963e0dcbe428da29884e0eb4c5ad6408d

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d9b3743b289486e90dbd66f614904fb963e0dcbe428da29884e0eb4c5ad6408d.exe
Size

170KB
MD5

75fb12e2afca747a1e76cb3449621950
SHA1

2a77e83ce6a47e8235a247253f84c29b3a573fbb
SHA256

d9b3743b289486e90dbd66f614904fb963e0dcbe428da29884e0eb4c5ad6408d
SHA512

6ff3feccaf2251f08d9512e695e0bcca1a598260ef819049b3442bc1a7e40a34a05cd9c29008cf4033f93ec13303dba1d010cee9dfda4b2be98929391b6f8da1
SSDEEP

3072:0MEMvxdknmg1tDbuLB+5xGT21JqaEvNAshAwPPVxAH0tEuFPAUovGG65N3:0ME1nmg1tDbJ5621YNA+AGm0GQP3GK5t

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2472	wdwg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	d9b3743b289486e90dbd66f614904fb963e0dcbe428da29884e0eb4c5ad6408d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2472	wdwg.exe
2472	wdwg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2472	4832	d9b3743b289486e90dbd66f614904fb963e0dcbe428da29884e0eb4c5ad6408d.exe	81
PID 4832 wrote to memory of 2472	4832	d9b3743b289486e90dbd66f614904fb963e0dcbe428da29884e0eb4c5ad6408d.exe	81
PID 4832 wrote to memory of 2472	4832	d9b3743b289486e90dbd66f614904fb963e0dcbe428da29884e0eb4c5ad6408d.exe	81

C:\Users\Admin\AppData\Local\Temp\d9b3743b289486e90dbd66f614904fb963e0dcbe428da29884e0eb4c5ad6408d.exe
"C:\Users\Admin\AppData\Local\Temp\d9b3743b289486e90dbd66f614904fb963e0dcbe428da29884e0eb4c5ad6408d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\wdwg.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\wdwg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\wdwg.exe

Filesize
106KB

MD5
ad9105e7fae63f2ebdb440d8c35e3dad

SHA1
9ceab14e34c20461112359f587c2e5a138c6d6d3

SHA256
9655751e955ae50d308f5a4c2e4ea7bf17a70095d2b62f4fb956096575863e90

SHA512
5e1790a842cb2612e2a3a494654ebb0255f1afaeb028c1e5bde81d49c6d2e172ec637036f7bad946ad3050bbc48362daaafc790f891b35203ebb6180ab06ef60

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\wdwg.exe

Filesize
106KB

MD5
ad9105e7fae63f2ebdb440d8c35e3dad

SHA1
9ceab14e34c20461112359f587c2e5a138c6d6d3

SHA256
9655751e955ae50d308f5a4c2e4ea7bf17a70095d2b62f4fb956096575863e90

SHA512
5e1790a842cb2612e2a3a494654ebb0255f1afaeb028c1e5bde81d49c6d2e172ec637036f7bad946ad3050bbc48362daaafc790f891b35203ebb6180ab06ef60

Download Submit