4c1fc6a16f378978da7c35f36525a4397a983255020fb709d0ad8cbe3f1e38e5

Analysis

max time kernel
165s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PL/setup331.exe
Size

2.0MB
MD5

2486b7f5f41d592ec4781b54cd828f70
SHA1

604009984d2f335a969ab447a61beec8661a99fe
SHA256

aa0a01e35fe2110068e1934eb568f5d3a41abe4b73a64a045f9a9ab8e085114c
SHA512

116cee6490ae2b631b0457c0ae328f88df74bff3b8f2b47652366cf125d22fc910733859825ed181ae547a664c15e5358c95cdd6b874c43cc426303bfd841370
SSDEEP

49152:3rBfJXAEYCT6v3vX/1AkJxopk7lDiQCv3e6rNx:3rBfKEYd3v+Ioi7Rg5x

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setup331.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	setup331.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

904 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
904	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

setup331.exe

description	pid	process	target process
PID 2332 wrote to memory of 904	2332	setup331.exe	regsvr32.exe
PID 2332 wrote to memory of 904	2332	setup331.exe	regsvr32.exe
PID 2332 wrote to memory of 904	2332	setup331.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe
"C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" -s MYQXM.k
2⤵
- Loads dropped DLL
PID:904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MYQXM.k
Filesize
1.8MB

MD5
942afe4b6c981193fda8ede7a57fd5bb

SHA1
62e6bb30e5a02920a3bbb1dffa7bd90d699afcd6

SHA256
99128a36e75d6739f15b1c5e8b40b5afe57740e6bf3d573c8636b26f78b2fb88

SHA512
2089221b9d554e51b016415b7e07c65ee0d76b1d3136a9424a98212ca812cb8d263d716d79cc4addca40f2c67df25ad642dfa903b6a641afba219bd9fc797955

Download Submit
C:\Users\Admin\AppData\Local\Temp\mYQxM.k
Filesize
1.8MB

MD5
942afe4b6c981193fda8ede7a57fd5bb

SHA1
62e6bb30e5a02920a3bbb1dffa7bd90d699afcd6

SHA256
99128a36e75d6739f15b1c5e8b40b5afe57740e6bf3d573c8636b26f78b2fb88

SHA512
2089221b9d554e51b016415b7e07c65ee0d76b1d3136a9424a98212ca812cb8d263d716d79cc4addca40f2c67df25ad642dfa903b6a641afba219bd9fc797955

Download Submit
memory/904-132-0x0000000000000000-mapping.dmp

Download
memory/904-135-0x0000000002E70000-0x0000000002F9E000-memory.dmp

Filesize
1.2MB

Download
memory/904-136-0x00000000030D0000-0x00000000031F9000-memory.dmp

Filesize
1.2MB

Download
memory/904-137-0x0000000003200000-0x00000000032BD000-memory.dmp

Filesize
756KB

Download
memory/904-138-0x00000000032D0000-0x0000000003379000-memory.dmp

Filesize
676KB

Download
memory/904-139-0x00000000032D0000-0x0000000003379000-memory.dmp

Filesize
676KB

Download
memory/904-141-0x00000000030D0000-0x00000000031F9000-memory.dmp

Filesize
1.2MB

Download