e0cbce8d4adc0ea5992c6d0acf0844ebc7efadc8e4a3b52cf7d7f9a1aadc30f0

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2022, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16a91ae398c80a1a38adbc58da9e4793.exe
Size 1.6MB
Sample221109-kczytsfbe7
SHA256 e0cbce8d4adc0ea5992c6d0acf0844ebc7efadc8e4a3b52cf7d7f9a1aadc30f0
MD5 16a91ae398c80a1a38adbc58da9e4793
SHA1 57522275f2c904850a4531f302e605f0d80b241b
SHA512 358b46dd0eb5f8a59c2c880f6eafa7681ae519356b9c67adfb0bb777828fa7b8ae3711be7d3aa9434759929c159776475b80e33b5221c226a4529c21ce4af5dd
SSDEEP 49152:908/RY1SQt2Lzl2cp7kgipGaDAw5RxlK/0jtK:e8/RvrygdaDA8Xo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	16a91ae398c80a1a38adbc58da9e4793.exe

Loads dropped DLL 4 IoCs

pid	Process
4648	rundll32.exe
4648	rundll32.exe
2556	rundll32.exe
2556	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	16a91ae398c80a1a38adbc58da9e4793.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 1540	5040	16a91ae398c80a1a38adbc58da9e4793.exe	83
PID 5040 wrote to memory of 1540	5040	16a91ae398c80a1a38adbc58da9e4793.exe	83
PID 5040 wrote to memory of 1540	5040	16a91ae398c80a1a38adbc58da9e4793.exe	83
PID 1540 wrote to memory of 4648	1540	control.exe	85
PID 1540 wrote to memory of 4648	1540	control.exe	85
PID 1540 wrote to memory of 4648	1540	control.exe	85
PID 4648 wrote to memory of 4700	4648	rundll32.exe	87
PID 4648 wrote to memory of 4700	4648	rundll32.exe	87
PID 4700 wrote to memory of 2556	4700	RunDll32.exe	88
PID 4700 wrote to memory of 2556	4700	RunDll32.exe	88
PID 4700 wrote to memory of 2556	4700	RunDll32.exe	88

C:\Users\Admin\AppData\Local\Temp\16a91ae398c80a1a38adbc58da9e4793.exe
"C:\Users\Admin\AppData\Local\Temp\16a91ae398c80a1a38adbc58da9e4793.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\X818TZ.CPL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\X818TZ.CPL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\X818TZ.CPL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4700
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\X818TZ.CPL",
        5⤵
        Loads dropped DLL
        
        PID:2556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

X818TZ.CPL

Path C:\Users\Admin\AppData\Local\Temp\X818TZ.CPL
Size 2.6MB
SHA256 26993ee016ea8d1ba458ad0fddcc6d810a9b82124fe8332317d33ca65601cfc4
MD5 dd15e9a1c7657e0e553b8761966d898f
SHA1 5bacd3af834d1aea0119cb546629e493d37f8d0c
SHA512 e0429f9989934253a27e166f4961fb62c9d2fe9faee3cf44e3fb9ec3958781009c81a12715193367140b3e7e83c3e7c445eb2b8e3bcaf99f0d322e603fe33a1a
SSDEEP 49152:iwARPCjwzo3g8EN+rNJV1orXRH83qdZnRsuvBxdJoVv:iwnjwf9N+JJHaXRc3QZRsuvdJo
MD5 SHA1 SHA512 SSDEEP

Submit Download

X818TZ.cpl

Path C:\Users\Admin\AppData\Local\Temp\X818TZ.cpl
Size 2.6MB
SHA256 26993ee016ea8d1ba458ad0fddcc6d810a9b82124fe8332317d33ca65601cfc4
MD5 dd15e9a1c7657e0e553b8761966d898f
SHA1 5bacd3af834d1aea0119cb546629e493d37f8d0c
SHA512 e0429f9989934253a27e166f4961fb62c9d2fe9faee3cf44e3fb9ec3958781009c81a12715193367140b3e7e83c3e7c445eb2b8e3bcaf99f0d322e603fe33a1a
SSDEEP 49152:iwARPCjwzo3g8EN+rNJV1orXRH83qdZnRsuvBxdJoVv:iwnjwf9N+JJHaXRc3QZRsuvdJo
MD5 SHA1 SHA512 SSDEEP

Submit Download

X818TZ.cpl

Path C:\Users\Admin\AppData\Local\Temp\X818TZ.cpl
Size 2.6MB
SHA256 26993ee016ea8d1ba458ad0fddcc6d810a9b82124fe8332317d33ca65601cfc4
MD5 dd15e9a1c7657e0e553b8761966d898f
SHA1 5bacd3af834d1aea0119cb546629e493d37f8d0c
SHA512 e0429f9989934253a27e166f4961fb62c9d2fe9faee3cf44e3fb9ec3958781009c81a12715193367140b3e7e83c3e7c445eb2b8e3bcaf99f0d322e603fe33a1a
SSDEEP 49152:iwARPCjwzo3g8EN+rNJV1orXRH83qdZnRsuvBxdJoVv:iwnjwf9N+JJHaXRc3QZRsuvdJo
MD5 SHA1 SHA512 SSDEEP

Submit Download

X818TZ.cpl

Path C:\Users\Admin\AppData\Local\Temp\X818TZ.cpl
Size 2.6MB
SHA256 26993ee016ea8d1ba458ad0fddcc6d810a9b82124fe8332317d33ca65601cfc4
MD5 dd15e9a1c7657e0e553b8761966d898f
SHA1 5bacd3af834d1aea0119cb546629e493d37f8d0c
SHA512 e0429f9989934253a27e166f4961fb62c9d2fe9faee3cf44e3fb9ec3958781009c81a12715193367140b3e7e83c3e7c445eb2b8e3bcaf99f0d322e603fe33a1a
SSDEEP 49152:iwARPCjwzo3g8EN+rNJV1orXRH83qdZnRsuvBxdJoVv:iwnjwf9N+JJHaXRc3QZRsuvdJo
MD5 SHA1 SHA512 SSDEEP

Submit Download

X818TZ.cpl

Path C:\Users\Admin\AppData\Local\Temp\X818TZ.cpl
Size 2.6MB
SHA256 26993ee016ea8d1ba458ad0fddcc6d810a9b82124fe8332317d33ca65601cfc4
MD5 dd15e9a1c7657e0e553b8761966d898f
SHA1 5bacd3af834d1aea0119cb546629e493d37f8d0c
SHA512 e0429f9989934253a27e166f4961fb62c9d2fe9faee3cf44e3fb9ec3958781009c81a12715193367140b3e7e83c3e7c445eb2b8e3bcaf99f0d322e603fe33a1a
SSDEEP 49152:iwARPCjwzo3g8EN+rNJV1orXRH83qdZnRsuvBxdJoVv:iwnjwf9N+JJHaXRc3QZRsuvdJo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2556-153-0x0000000003140000-0x00000000031F8000-memory.dmp

Download

memory/2556-151-0x0000000002A10000-0x0000000002ADC000-memory.dmp

Download

memory/2556-149-0x0000000002D20000-0x0000000002F23000-memory.dmp

Download

memory/2556-150-0x0000000003030000-0x0000000003131000-memory.dmp

Download

memory/2556-155-0x0000000003030000-0x0000000003131000-memory.dmp

Download

memory/2556-148-0x0000000002660000-0x0000000002903000-memory.dmp

Download

memory/4648-137-0x0000000002F10000-0x00000000031B3000-memory.dmp

Download

memory/4648-142-0x00000000039E0000-0x0000000003A98000-memory.dmp

Download

memory/4648-141-0x00000000039E0000-0x0000000003A98000-memory.dmp

Download

memory/4648-140-0x0000000003910000-0x00000000039DC000-memory.dmp

Download

memory/4648-139-0x0000000003800000-0x0000000003901000-memory.dmp

Download

memory/4648-138-0x00000000034F0000-0x00000000036F3000-memory.dmp

Download

memory/4648-156-0x0000000003800000-0x0000000003901000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads