Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
28/10/2022, 02:54
Static task
static1
Behavioral task
behavioral1
Sample
Details.lnk
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Details.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
disallowable/expiated.cmd
Resource
win7-20220901-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
disallowable/expiated.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
disallowable/footballers.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
disallowable/footballers.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target Details.lnk
- Size 1KB
- Sample221028-dd39baeda8
- SHA256 e6cb04ff892f951faa671dfa5888254715ff332dad732ef2c11c2abffce8e703
- MD5 0ed29fb82183c419d45096dc9876eeb1
- SHA1 b7f3327a5a43f19b6a89f1943e574704e5e57227
- SHA512 f8a5d30d2ff439003894595f0ef5f6a20c82ad3be56bbb71ab9171a4d24bf9149417ca00688051dbd41dd19eff661ebdcb61f25f7941856447df2e618acf7a01
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 460 regsvr32.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation cmd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4308 regsvr32.exe 4308 regsvr32.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe 2496 wermgr.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4308 regsvr32.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4720 wrote to memory of 1980 4720 cmd.exe 83 PID 4720 wrote to memory of 1980 4720 cmd.exe 83 PID 1980 wrote to memory of 4656 1980 cmd.exe 84 PID 1980 wrote to memory of 4656 1980 cmd.exe 84 PID 1980 wrote to memory of 460 1980 cmd.exe 85 PID 1980 wrote to memory of 460 1980 cmd.exe 85 PID 460 wrote to memory of 4308 460 regsvr32.exe 86 PID 460 wrote to memory of 4308 460 regsvr32.exe 86 PID 460 wrote to memory of 4308 460 regsvr32.exe 86 PID 4308 wrote to memory of 2496 4308 regsvr32.exe 87 PID 4308 wrote to memory of 2496 4308 regsvr32.exe 87 PID 4308 wrote to memory of 2496 4308 regsvr32.exe 87 PID 4308 wrote to memory of 2496 4308 regsvr32.exe 87 PID 4308 wrote to memory of 2496 4308 regsvr32.exe 87
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Details.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c disallowable\expiated.cmd r3 2.e xe2⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\system32\replace.exereplace C:\Windows\system32\regsvr32.exe C:\Users\Admin\AppData\Local\Temp /A3⤵PID:4656
-
-
C:\Users\Admin\AppData\Local\Temp\regsvr32.exeregsvr32.exe disallowable\footballers.dat3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\regsvr32.exedisallowable\footballers.dat4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2496
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\regsvr32.exe
- Size 24KB
- SHA256 022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
- MD5 b0c2fa35d14a9fad919e99d9d75e1b9e
- SHA1 8d7c2fd354363daee63e8f591ec52fa5d0e23f6f
- SHA512 a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022
- SSDEEP 384:n5Y3wBQ8l/m60z+G7XU9I6ExBOMDl16AvcX9dp/Ql7YQCrA2WrcLHW:n5Yg3l/mTRXU9FeGpX9dp/47tCnL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\regsvr32.exe
- Size 24KB
- SHA256 022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
- MD5 b0c2fa35d14a9fad919e99d9d75e1b9e
- SHA1 8d7c2fd354363daee63e8f591ec52fa5d0e23f6f
- SHA512 a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022
- SSDEEP 384:n5Y3wBQ8l/m60z+G7XU9I6ExBOMDl16AvcX9dp/Ql7YQCrA2WrcLHW:n5Yg3l/mTRXU9FeGpX9dp/47tCnL
- MD5 SHA1 SHA512 SSDEEP