22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be

Analysis

max time kernel
188s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe
Size

658KB
MD5

601ddad314b61246283fcaacdb1f9940
SHA1

f8e47b1bbcc07bd06e47bbb409a7cefe50c8cc3a
SHA256

22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be
SHA512

98aab411fc22ed4d8db9a6ccee4e72c4cfea9a27833a6f315d7a738f66c30d15ba7bcae386581d123186305eadcc0fe28b0a99bf3ea3f4caa0240ca1e536f084
SSDEEP

12288:SaejG/5NwYkK19iOCr+TMoO30mYn0YaAsGhQHxM5DKTrH5eZQ2d:2jGAK19iOCr+TMoO30mYn0YaAstHxM5h

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.Net CLR\Parameters\ServiceDll = "C:\\Windows\\system32\\e57594b.dll"	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe

Loads dropped DLL 3 IoCs

pid	Process
4784	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe
1296	svchost.exe
3984	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\e57594b.dll	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4784	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 3984	1296	svchost.exe	82
PID 1296 wrote to memory of 3984	1296	svchost.exe	82
PID 1296 wrote to memory of 3984	1296	svchost.exe	82
PID 4784 wrote to memory of 1120	4784	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe	83
PID 4784 wrote to memory of 1120	4784	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe	83
PID 4784 wrote to memory of 1120	4784	22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe	83

C:\Users\Admin\AppData\Local\Temp\22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe
"C:\Users\Admin\AppData\Local\Temp\22b4558e1d6d66465e5ef3241d3688a5e38c133820a4aa66a0494dc01481a0be.exe"
1⤵
- Sets DLL path for service in the registry
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\22B455~1.EXE" > nul
  2⤵
  PID:1120

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k ".Net CLR"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe c:\windows\system32\e57594b.dll, Launch
  2⤵
  - Loads dropped DLL
  PID:3984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\e57594b.dll

Filesize
610KB

MD5
2b194e786f58b20023e29bd464843c4e

SHA1
00601e9d4908b252af37e45ce06e04b587911e30

SHA256
afd906c340b56687ddff5f95ee62830b77eadc2008e88cb1117bac26b33a653d

SHA512
ed7b53b308126922a73965f1c9fdd5faeb2c3662adacc1b3cf1474b171c766c479ddc81e9a2a8813106a96a44b092800977c374f8027d7565228422f4a46b476

Download Submit
C:\Windows\SysWOW64\e57594b.dll

Filesize
610KB

MD5
2b194e786f58b20023e29bd464843c4e

SHA1
00601e9d4908b252af37e45ce06e04b587911e30

SHA256
afd906c340b56687ddff5f95ee62830b77eadc2008e88cb1117bac26b33a653d

SHA512
ed7b53b308126922a73965f1c9fdd5faeb2c3662adacc1b3cf1474b171c766c479ddc81e9a2a8813106a96a44b092800977c374f8027d7565228422f4a46b476

Download Submit
C:\Windows\SysWOW64\e57594b.dll

Filesize
610KB

MD5
2b194e786f58b20023e29bd464843c4e

SHA1
00601e9d4908b252af37e45ce06e04b587911e30

SHA256
afd906c340b56687ddff5f95ee62830b77eadc2008e88cb1117bac26b33a653d

SHA512
ed7b53b308126922a73965f1c9fdd5faeb2c3662adacc1b3cf1474b171c766c479ddc81e9a2a8813106a96a44b092800977c374f8027d7565228422f4a46b476

Download Submit
\??\c:\windows\SysWOW64\e57594b.dll

Filesize
610KB

MD5
2b194e786f58b20023e29bd464843c4e

SHA1
00601e9d4908b252af37e45ce06e04b587911e30

SHA256
afd906c340b56687ddff5f95ee62830b77eadc2008e88cb1117bac26b33a653d

SHA512
ed7b53b308126922a73965f1c9fdd5faeb2c3662adacc1b3cf1474b171c766c479ddc81e9a2a8813106a96a44b092800977c374f8027d7565228422f4a46b476

Download Submit