317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17

Analysis

max time kernel
89s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17.exe
Size 814KB
Sample221031-2w382aehcm
SHA256 317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17
MD5 2fafd81ce2a7cf25fa73863d098de711
SHA1 a84f8b96d702d24786f5bd500f5620982a080c40
SHA512 3563c68b365befefc8e1bdffa51d31025d6fdeef7f210da7d54c10c4f54d365b23ce5868808cfc68f084a4a27ae5689750a8349d2fefe112b1abcb65ca8cbbc7
SSDEEP 12288:l0nyfXuIBDtfuCSHjWb8LM1cWMU66Pmgfc1Snv2QJz88WZBtVAXWc0:Sny/f9uCMWdqU66jESnv2Qx8HZBHM0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
924	DPInst64.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DPINST.LOG	DPInst64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 924	3208	317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17.exe	81
PID 3208 wrote to memory of 924	3208	317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17.exe	81

C:\Users\Admin\AppData\Local\Temp\317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17.exe
"C:\Users\Admin\AppData\Local\Temp\317ee3f84dafc40dac46642ae917cb42fdcb185e43bfb78dc3d6cbc9c4472e17.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPInst64.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPInst64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DPInst64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPInst64.exe
Size 908KB
SHA256 ef6c5fe9f08be67f24c7dfa5c7bc3d69ab4e387e6065602d45ba358289f05117
MD5 c3ac43b2018114a617e946aa8fdf3cac
SHA1 2d90f38bc995c9cd5efec52109f8bd2468001ca7
SHA512 8c471a2575751c5995b10859219b979d75c8e8e4496604c0718268d8367790c5bb8e6dd47c735dcecd02a62dbb0d8fbbb70ea1d085ad7b798491a3d831cd9488
SSDEEP 6144:JcQsynWrZI8I/VELVqZFbq+0pHKmdTJF805CbLLDFSQSAj99HJYnJzDX+v34nQTy:mpRkVWqZRqXVI0oLD7ZxA434QTPh2F
MD5 SHA1 SHA512 SSDEEP

Submit Download