8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3

Analysis

max time kernel
131s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe
Size

18KB
MD5

0a6ef0779b91000bc5c1a84b4843f3b0
SHA1

ffacae95ce6ccf791688bacccb99c8b07f44cabb
SHA256

8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3
SHA512

0027b2d3a8549ca5077005db0b7685c3de8648541ef343e08137ae741b9d09b3d7015c4d60165d80a8924c17f1da0e088d6ad8191f4b876bbe41a047a34b6b18
SSDEEP

192:Mcbkdw86m00Q96odRNyCiq/xEDvJ5Ao5iFVpUX7ZUSoQkC4duC8ffb1Ettz:BkSnmQgodRN5iqEDvTwFVm91kChhEttz

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2060	viewpdf_updater.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	viewpdf_updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3488	2060	WerFault.exe	82

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2060	4880	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe	82
PID 4880 wrote to memory of 2060	4880	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe	82
PID 4880 wrote to memory of 2060	4880	8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe	82
PID 2060 wrote to memory of 3488	2060	viewpdf_updater.exe	91
PID 2060 wrote to memory of 3488	2060	viewpdf_updater.exe	91
PID 2060 wrote to memory of 3488	2060	viewpdf_updater.exe	91

C:\Users\Admin\AppData\Local\Temp\8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe
"C:\Users\Admin\AppData\Local\Temp\8a3b6b9f22ffa8f61a095f6f95b85caa91ebe1811e06d55ca8b2413d1afa43b3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe
  "C:\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 62680
    3⤵
    - Program crash
    PID:3488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe

Filesize
18KB

MD5
52cc037c69c23e279f4b7082732c9175

SHA1
5d68f18513e84d4f0cc5a63c6ef5201f0d730945

SHA256
78f7c647bb132fbdc1c561ddc3cc4001ba5989411ee7006f511941259578440b

SHA512
076ca07eba001f2831c414ee3a7b366970e08f335ebde16504bed5e100c1e0caa896f6a8b2a7f6c411865873445a591011e18e618a585b3e6c3e47384e0107a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\viewpdf_updater.exe

Filesize
18KB

MD5
52cc037c69c23e279f4b7082732c9175

SHA1
5d68f18513e84d4f0cc5a63c6ef5201f0d730945

SHA256
78f7c647bb132fbdc1c561ddc3cc4001ba5989411ee7006f511941259578440b

SHA512
076ca07eba001f2831c414ee3a7b366970e08f335ebde16504bed5e100c1e0caa896f6a8b2a7f6c411865873445a591011e18e618a585b3e6c3e47384e0107a5

Download Submit
memory/2060-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4880-133-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4880-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download